I have made a version of XAV with support for McAfee. In this version I extract the virusname from the report file and put it in the log(you can put the log file where you want). The basic support for other scanners is available, but doesn't support multithreading well. It should not be a big job to include the virus name in the already generated feedback message. If interested send me a mail at [EMAIL PROTECTED] Dick Spork
IAt 02:46 13-03-2004, you wrote: >Jason - I'm surprised there wasn't a burst of feedback on the list about >formatting mail. I am no expert, but there has been much discussion here >about that, and the RFC's that govern their structure. I imagine you are >thinking of dropping your notices into the xmail local pickup directory - >which makes sense to me. > >It would take a little extra finesse, but it would be extra nice to parse >the name of the virus that has been found, and include that information in >the notification you send to your users. Since the various AV engines use >different looking reports, perhaps you could include in the XAV.INI file a >place to tell the system how to find the virus name in the report (an >instring type of search looking for a common phrase which is present only >when a virus is detected). The admin would have to figure out the report >format of whatever virus scanner they are using, and provide the reference >in the XAV.ini. I hope you will consider these suggestions. Of course, its >easy for somebody who is NOT doing the actual programming to make >suggestions all night long - :-) > >I would also like to see your XAV mods - I tried to email your address >directly to ask about this, but your server filtered my message. How can we >get together on this? > >Liron Newman asked what I had been doing wrong when XAV wasn't working for >me... >For one thing, I have just upgraded from XMAIL 1.10 to 1.16 - and I did not >have the XAV.TAB file in the proper location (filters), but in mailroot (not >correct!). For another thing, I don't read C source to well, and did not >realize that the section headers [ bla ] must be exactly as they are in the >included ini file. I thought to make changes there when I added a different >AV scanner - but I made the mistake of somehow disturbing the functions of >the [sectionheader] portions. When I put them all just the way they were to >begin with (no additional sections), things seemed to improve. > >Also, someone recently asked about the # of domains, etc, that our xmail >installations handle. We are not large, but xmail is very robust, solid. >Davide has created a wonderful engine for us to use - and we all thank him >very much!! Our stats for February look like this: > >Domains: 25 >Users: Approx 210 >SMAIL 289,623 >POP3 1,602,361 >SMTP 657,296 >Size: 1067.26 Mb >Number of xmail error/problems 0 > >Thank to everyone who offered suggestions to me with XAV. Jason, and Tracy >especially! > > >----- Original Message ----- >From: "Jason Badry" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Friday, March 12, 2004 12:54 PM >Subject: [xmail] Filters - XAV / Message Modification > > > > I've decided that I am going to pass on the header and a message (with > > modified subject line) to virus recipients saying that a virus was > > intercepted. This way if there is a false positive they can let me know > > and I can go and check the keep folder for them. It is also nice to > > 'advertise' that you did intercept the virus for them aka job security. > > > > My plan is to do further modifications to XAV to this end, but I do not > > know much about the structure of the email files. What is the format of > > the file / is the first blank line basically the end of the header? Are > > there any other formatting rules to follow? > > > > Thanks, > > > > ... Jason Badry > > > > - > > To unsubscribe from this list: send the line "unsubscribe xmail" in > > the body of a message to [EMAIL PROTECTED] > > For general help: send the line "help" in the body of a message to > > [EMAIL PROTECTED] > > > > > >- >To unsubscribe from this list: send the line "unsubscribe xmail" in >the body of a message to [EMAIL PROTECTED] >For general help: send the line "help" in the body of a message to >[EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
