Anyone here use clamav?

[Robert Boucneau]

>Two more questions.

>#1 - What do you do with an mbox that is infected? On my scan it said
>there was something infected in evolution. How do I find out what email
>that is?

>#2 - It turned up infected messages in Pan. Is there any way to filter
>these?

>Preston


Hi Preston,

I'm not saying this is the "best" solution, but this is what one of our
people (Brian Young) does for one client:

(Things you need to change are inside square brackets: "[.*]"...

He set up a shell script:

	#!/bin/sh
	# Don't run this in the actual mail directory (/var/spool/mail, for
example!)

	# Get mail box info
	 echo "Enter Users Mailbox Name"
	 read fname

	# Clear any old message files from current directory
	 # rm -f mail* (if you're feeling confident!) (but there shouldn't be any
anyway!)
	 rm mail*

	# copy mailbox to local directory.
	 cp [path-to-mailbox-to-be-scanned]/$fname .

	# Set rights (as you are probably running as root.)
	 chown $fname $fname
	 chgrp mail $fname
	 chmod 660 $fname

	# split the mailbox into individual messages (kludgy)
	# formail comes with procmail, writeit is a Perl program (below)
	 cat $fname|formail -s ./writeit

	# Scan the component messages, remove infected files
	# The log file can go anywhere, make sure it's a valid path you have rw to.
	 clamscan --mbox -r --log=[path-to]/viruses.txt --remove mail*

	# Glue the remaining files together and move back to original location
	 cat mail* > $fname
	 rm -f mail*
	 mv -f $fname [path-to-mailbox-to-be-scanned]

	# Send a note describing the mess to yourself
	 sendmail [youremail at addresshere.com] < [path-to]/viruses.txt
	 rm -f [path-to]/viruses.txt


Writeit "Program"

	#!/usr/bin/perl
	undef $count;
	open (C, "<[path-to]/count");
	while (<C>) {if (! $count) {$count=$_;}}
	close C;
	open (C, ">count");
	$count++;
	print C "$count";
	close C;
	open (OUT, ">mail$count.mbx");   #Leave mail, but replace broker with users
mailbox name
	while (<STDIN>) {print OUT "$_"};
	close OUT;

Count File
	Make a file called [path-to]/count with 0 as the first line

I'd play with this on a *copy* of the mail until you get it working the way
you want it to...

Bob