Re: [cobalt-users] Raq550: MailScanner virus list autoupdate

[Larry Smith <lesmith@xxxxxxxxx>]

On Sunday 28 September 2003 21:29, John D Gorena wrote:
> David Lucas wrote:
> > At 07:47 PM 9/28/2003, you wrote:
> > >The instructions for mailscanner state that autoupdate should be run
> > > daily for virus lists.  Does anyone know if they mean just mailscanner
> > > or if they mean only with an added Virus program?  MailScanner comes
> > > with a virus scan as it is
> > >removing some emails.  How do we update those definitions?
> >
> > mailscanner does NOT come with a virus scanner by default
> > it is set up by default to delete some attachments, and the comment for
> > some of them is that they are a virus.  This info is located in the file
> > filename.rules.conf.
> > the autoupdate is for the virus extensions
> >
> > --
>
> Understood - Thanks - but how do we update those extensions?
>
> John

John,

  Believe the file you are looking for is filename.rules.conf in the 
/home/opt/MailScanner/etc directory.  Here is a "cut" from the file:

<quote>
# These 3 are well known viruses.
deny    pretty\s+park\.exe$     "Pretty Park" virus              
                            		"Pretty Park" virus
deny    happy99.exe$            "Happy" virus                     
                                              "Happy" virus
deny    message.zip$            "W32.Mimail" virus              
                                                        "W32.Mimail" virus
#
# These are known to be dangerous in almost all cases.
deny    \.reg$          Possible Windows registry attack               
                                 Windows registry entries are very dangerous
				in email
</quote>

-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx