Hi,

since 4 days, i get about 7 - 14 emails from some spammers, who attach so
called m$-patches to their mails. all of these have a signature of the
worm/glide.c ...

i have fetchmail, mailscanner (sendmail), spamassassin 2.55 and procmail
installed and this is what happenes:

- mailscanner detects the viurses and adds the email-header
"X-myhost-MailScanner: Found to be infected"

- spamassassin just scores them 0,8 (configured to required_hits 5)

- the virus-spamming-emails are sent to root@localhost.localdomain, who is
aliased to my useraccount

- i have whitelisted mails from root@localhost.localdomain, so that i get
logwatchreports and so on


After all, i get the notifications of these virusdetections. What do i have
to do get rid of them?

- i do not want the attachments to be saved into
/var/spool/MailScanner/quaratine

- i do not want to get these notifications

- i just want to get rid of these mails


Is it sufficient to add these lines to my /etc/procmailrc?

:0:
* ^X-abyss-MailScanner: Found to be infected
/dev/null


or is there a better way to configure /etc/Mailscanner/Mailscanner.conf ???


Thankx a lot
A.

[ Post a follow-up to this message ]

On Tue, 23 Sep 2003 21:37:06 +0200, A. <nospam@home.org>:
quote:

>
> since 4 days, i get about 7 - 14 emails from some spammers, who attach so
> called m$-patches to their mails. all of these have a signature of the
> worm/glide.c ...


I've got over 100 Mb in the last 12 hours.
quote:

> i have fetchmail, mailscanner (sendmail), spamassassin 2.55 and procmail
> installed and this is what happenes:
>
> - mailscanner detects the viurses and adds the email-header
> "X-myhost-MailScanner: Found to be infected"


Don't know or use mailscanner.
quote:

> - spamassassin just scores them 0,8 (configured to required_hits 5)


Try "score MICROSOFT_EXECUTABLE 5.100" or somesuch (hope you don't
actually believe useful things can arrive as executable email
attachments).
quote:

> After all, i get the notifications of these virusdetections. What do i hav
e
> to do get rid of them?
>
> - i do not want the attachments to be saved into
> /var/spool/MailScanner/quaratine
>
> - i do not want to get these notifications
>
> - i just want to get rid of these mails


# REMOVE THE EMBEDDED "_" TO USE THIS!
:0 B
*  ()AJBAPACQQDkAkEA3AJBANACQQDEAkEAvAJ_BAL
ACQQCoAkEApAJBAJwCQQCUAkEAjAJBAIQC
QQB8
{
LOG="Worm Footprint - "
:0
/dev/null
}


--
Any technology distinguishable from magic is insufficiently advanced.
(*)               http://www.spots.ab.ca/~keeling
- -  http://learn.to/quote (Deutsch)      http://quote.6x.to (Eng.)
Spammers!    http://www.spots.ab.ca/~keeling/spammers.html

[ Post a follow-up to this message ]

On Tue, 23 Sep 2003 21:37:06 +0200, "A." <nospam@home.org> wrote:
quote:

>Hi,
>
>since 4 days, i get about 7 - 14 emails from some spammers, who attach so
>called m$-patches to their mails. all of these have a signature of the
>worm/glide.c ...
>
>i have fetchmail, mailscanner (sendmail), spamassassin 2.55 and procmail
>installed and this is what happenes:
>
>- mailscanner detects the viurses and adds the email-header
>"X-myhost-MailScanner: Found to be infected"
>
>- spamassassin just scores them 0,8 (configured to required_hits 5)
>
>- the virus-spamming-emails are sent to root@localhost.localdomain, who is
>aliased to my useraccount
>
>- i have whitelisted mails from root@localhost.localdomain, so that i get
>logwatchreports and so on
>
>
>After all, i get the notifications of these virusdetections. What do i have
>to do get rid of them?
>
>- i do not want the attachments to be saved into
>/var/spool/MailScanner/quaratine
>
>- i do not want to get these notifications
>
>- i just want to get rid of these mails
>
>
>Is it sufficient to add these lines to my /etc/procmailrc?
>
>:0:
>* ^X-abyss-MailScanner: Found to be infected
>/dev/null
>
>
>or is there a better way to configure /etc/Mailscanner/Mailscanner.conf ???
>
>
>Thankx a lot
>A.


I guess you have been in a cave for the last few days! Head over to
comp.os.linux.misc. There are about 300 or more comments posted so
far.


Now are you talking about what it is you know
Or just repeating what it was you heard.
Grace Slick


Rich Piotrowski
To E-mail use: rpiotro(at)wi(dot)rr(dot)com

[ Post a follow-up to this message ]

On Tue, 23 Sep 2003 21:37:06 +0200, A. <nospam@home.org> wrote:
quote:

> Is it sufficient to add these lines to my /etc/procmailrc?
>
>:0:
> * ^X-abyss-MailScanner: Found to be infected
> /dev/null


Change :0: to :0. I don't know anything of Mailscanner, but if that is a
valid header when it hits procmail, that should do the trick.

--
Hal Burgiss

[ Post a follow-up to this message ]