On Tue, 27 Jan 2004 at 12:53:54 +0000, Brian Read wrote: > I am getting lots of these, and clamav is detecting them fine, but it > clearly is trying to email back the "sender" with a notification. > As the reply to is spoofed, this makes no sense at all (and i am getting
Sure! > lots of bounces). How do we stop this happening? > As far as I can see, you use Amavis-ng. I don't know Amavis-ng but maybe it has some similarities in its config to Amavisd-new. In Amavisd-new there is the parameter named viruses_that_fake_sender_re. Mine is now: $viruses_that_fake_sender_re = new_RE( qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i, qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|gibe'i, qr'exploit\.iframe\.gen|bics|bagle|worm.sco'i, ); -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
