[Mimedefang] Score Clamav Results

Jonas Eckerman jonas_lists at frukt.org
Wed May 20 19:58:39 EDT 2009

Jeff Grossman wrote:

> I am starting to use some third party clamav virus databases and would
> like to score the results instead of just delete the e-mail which contains
> a hit.

I'm doing this in a different way. I have to instances of clamd running.

One instance is only running official signatures and have phishing 
detection turned off, doesn't consider broken zip files as virii, etc. 
This is used by mimedefang-filter.

The other instance have some third party signature databases added, has 
phishing detection on, considers triggers on more stuff than the first 
instance. This instance is used by the SpamAssassin clamav plugin so it 
contributes to SA scores.

I did it in the way you suggests before, but I find this way easier 
since now I don't have to keep up with the signature namings.


Jonas Eckerman
Fruktträdet & Förbundet Sveriges Dövblinda

More information about the MIMEDefang mailing list