[Mimedefang] Score Clamav Results
Jeff Grossman
jeff at stikman.com
Tue May 19 22:40:39 EDT 2009
On 5/19/2009 3:43 PM, Dirk the Daring wrote:
> On Tue, 19 May 2009, mimedefang-request at lists.roaringpenguin.com wrote:
>
>> ----------------------------------------------------------------------
>> Message: 1
>> From: "Jeff Grossman" <jeff at stikman.com>
>>
>> I am starting to use some third party clamav virus databases and would
>> like to score the results instead of just delete the e-mail which
>> contains
>> a hit. I am not a very good Perl programmer. Does anybody have any
>> examples of scoring those results based on the signature name? If so,
>> would you be willing to share them with me?
>
> ---- Cut Here ----
> sub filter_begin
> {
> my($entity) = @_;
>
> # ...blah blah... #
>
> # Scan for viruses using ClamAV (clamd)
> my($code, $category, $action) = message_contains_virus_clamd();
>
> # Look to see if virus was found
> if ($category eq 'virus')
> {
> # Check to see if it is a specific virus
> # $VirusName is a global variable in MIMEDefang
> # and was populated by the call to
> # message_contains_virus_clamd()
> if ($VirusName eq 'Signature-Name-Here')
> {
> # Do Whatever
> }
> }
>
> # ...blah blah... #
>
> }
> ---- Cut Here ----
>
Thank you very much for the included example. I went and made the
changes to my script. But, I was pulling my hair out because it won't
work. I think I figured it out. The code I am using is checking for a
specific virus name, if found it is adding a header. I have added a
SpamAssassin check to look for this header and increase the spam score
if the header is found. I think my problem is that MIMEDefang is not
adding the header before it calls SpamAssassin. It is adding the header
after all of the checks are done. How can I add the header before
SpamAssassin is called so I can increase the SpamAssassin score?
If somebody has a better method please let me know.
Thanks,
Jeff
More information about the MIMEDefang
mailing list