[Mimedefang] clamav oddity

[Ashley M. Kirchner]

David F. Skoll wrote:

>I forgot... MIMEDefang adds a "From_" line before it passes the
>message to clam, to help it recognize it as an e-mail.  It won't
>work without that line (which is missing from ENTIRE_MESSAGE)
>
    Aha, now I'm seeing the differences.  The two qdirs it successfully 
identified, both have full message headers in ENTIRE_MESSAGE:

-----
Received: from localhost (localhost)
        by relay2.germany.net (8.13.0.PreAlpha4/8.13.0.PreAlpha4) id 
i3U80hd1028058;
        Fri, 30 Apr 2004 10:00:43 +0200 (MEST)
Date: Fri, 30 Apr 2004 10:00:43 +0200 (MEST)
From: Mail Delivery Subsystem <MAILER-DAEMON at relay2.germany.net>
Message-Id: <200404300800.i3U80hd1028058 at relay2.germany.net>
To: <ashley at pcraft.com>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
        boundary="i3U80hd1028058.1083312043/relay2.germany.net"
Subject: Returned mail: see transcript for details
Auto-Submitted: auto-generated (failure)
-----


    The ones it doesn't identify however, look like this:

-----
From: ducheff at ieg.com.br
To: jim at interrobang.org
Subject: Re: Here is the document
Date: Fri, 30 Apr 2004 09:09:16 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
        boundary="----=_NextPart_000_0002_00000AE8.000025F7"
X-Priority: 3
X-MSMail-Priority: Normal
-----



    Is that way it won't "see" them?  And if so, how can I save all of 
them with complete headers?  Right now, this is what mimedefang-filter 
has in it:

-----
    if ($FoundVirus) {
        md_graphdefang_log('virus', $VirusName, $RelayAddr);
        md_syslog('warning', "Virus $VirusName found.");
        $QuarantineDir = '/var/spool/MD-Quarantine/virus';
        action_quarantine_entire_message("Message quarantined because of 
virus: $VirusName.");
        $QuarantineDir = '/var/spool/MD-Quarantine';
        return action_discard();
    }
-----

-- 
W | I haven't lost my mind; it's backed up on tape somewhere.
  +--------------------------------------------------------------------
  Ashley M. Kirchner <mailto:ashley at pcraft.com>   .   303.442.6410 x130
  IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
  Photo Craft Laboratories, Inc.            .     3550 Arapahoe Ave. #6
  http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A.