[Mimedefang] TestVirus.org

[Mark Sheppard]

On 2004-07-29 (Thursday) at 17:43:18 -0700, Kenneth Porter wrote:
> Just saw this on the Procmail Sanitizer list:
>
> <http://www.testvirus.org/>
>
> >This web site allows you to send a harmless test virus to any
> >email address.  If your mail server or email hosting provider is
> >running anti-virus software, these emails should get blocked.
> >Brought to you by Webmail.us

That's not the case if you've done what I have and put the following
code in mimedefang-filter (this is with ClamAV):

    if ($FoundVirus and $VirusName ne 'Eicar-Test-Signature') {
        md_graphdefang_log('virus', $VirusName, $RelayAddr);
        md_syslog('warning', "Discarding because of virus $VirusName");
        return action_discard();
    }

I did that because one of my users is on a mailing list that discussed
that test signature in detail a while back and included it in many of
the posts in the discussion.  As it was legitimate email I made sure
it wasn't blocked.  Hopefully no one will complain about lack of virus
scanning if they manage to mail themselves Eicar!

Mark.