[Mimedefang] Score Clamav Results

Jeff Grossman jeff at stikman.com
Tue May 19 22:40:39 EDT 2009


On 5/19/2009 3:43 PM, Dirk the Daring wrote:
> On Tue, 19 May 2009, mimedefang-request at lists.roaringpenguin.com wrote:
>
>> ----------------------------------------------------------------------
>> Message: 1
>> From: "Jeff Grossman" <jeff at stikman.com>
>>
>> I am starting to use some third party clamav virus databases and would
>> like to score the results instead of just delete the e-mail which 
>> contains
>> a hit.  I am not a very good Perl programmer.  Does anybody have any
>> examples of scoring those results based on the signature name?  If so,
>> would you be willing to share them with me?
>
> ---- Cut Here ----
> sub filter_begin
>     {
>     my($entity) = @_;
>
>     # ...blah blah... #
>
>     # Scan for viruses using ClamAV (clamd)
>         my($code, $category, $action) = message_contains_virus_clamd();
>
>     # Look to see if virus was found
>     if ($category eq 'virus')
>         {
>             # Check to see if it is a specific virus
>             #    $VirusName is a global variable in MIMEDefang
>             #    and was populated by the call to
>             #    message_contains_virus_clamd()
>                         if ($VirusName eq 'Signature-Name-Here')
>                 {
>                     # Do Whatever
>                 }
>         }
>
>     # ...blah blah... #
>
>     }
> ---- Cut Here ----
>
Thank you very much for the included example.  I went and made the 
changes to my script.  But, I was pulling my hair out because it won't 
work.  I think I figured it out.  The code I am using is checking for a 
specific virus name, if found it is adding a header.  I have added a 
SpamAssassin check to look for this header and increase the spam score 
if the header is found.  I think my problem is that MIMEDefang is not 
adding the header before it calls SpamAssassin.  It is adding the header 
after all of the checks are done.  How can I add the header before 
SpamAssassin is called so I can increase the SpamAssassin score?

If somebody has a better method please let me know.

Thanks,
Jeff



More information about the MIMEDefang mailing list