Re: Viruses 'W32/Sobig.F Worm'

[Aly Dharshi <aly dharshi uleth ca>]

Hello,

	Again this is pertaining to mail and the way mail works or mail admin's
preference in the way they handle infected mail.

	ClamAV will scan your filesystems such as /home or /usr but I don't
think that it will clean the file out. So if you are using Samba and you
have an infected windows file it will detect the file as an infected
file but will not clean the infection for example. I am sure that you
could extend this to isolating user files during the scan to remove them
or do something funky to them but there is no option to clean it.

	Cheers,

	Aly.

On Mon, 2003-09-08 at 13:13, Distribution Lists wrote:
> This is not entirely true...
> I use a combination of ClamAv (Antivirus), Amavis (virus scanner), Postfix
> (MTA).
> 
> With the right configuration, any virus (that clamav has a signature for)
> found in a attachment from an email will be quarantined to a directory of
> your choosing. The recipient will not receive the email.
> 
> Regards
> 
> > You can use the opensource ClamAV with your mail system with say Exim +
> > Exiscan patch as mail server or Sendmail, Postfix etc etc. It will scan
> > your file systems but WILL NOT remove viruses from those files for you.
> > You may want to look at commercial packages such as Sophos for this, if
> > they support these features.
> >
> > 	Cheers,
> >
> > 	Aly.
> >
> > On Mon, 2003-09-08 at 12:39, Richard Crawford wrote:
> >> Graham Leggett said:
> >> > Richard Crawford wrote:
> >> >
> >> >> Linux is not susceptible to the W32/Sobig.F worm, so I wouldn't worry
> >> >> about it.
> >> >
> >> > A Linux mailserver is susceptible to running out of disk space due to
> >> > the worm, which has happened to me twice.
> >> >
> >> > Best advice is to install a virus killer on your mailsystem.
> >>
> >> This is true... though I understood the original post to express concern
> >> that their Linux computer would be actually infected with the worm.
> >>
> >> But yeah, the worm can make traffic increase to the point where the
> >> server
> >> is overrun with activity.
> >>
> >>
> >> Sliante,
> >> Richard S. Crawford
> >>
> >> http://www.mossroot.com
> >> AIM: Buffalo2K ICQ: 11646404 Y!: rscrawford
> >> MSN: underpope hotmail com
> >> Howard Dean for America:  http://www.deanforamerica.com
> >> "It is only with the heart that we see rightly; what is essential is
> >> invisible to the eye." --Antoine de Saint Exupéry
> > --
> > Aly S.P Dharshi
> > aly dharshi uleth ca
> > Southern Alberta Digital Library Project
> >
> >         "A good speech is like a good dress
> >          that's short enough to be interesting
> >          and long enough to cover the subject"
> >
> >
> > --
> > redhat-list mailing list
> > unsubscribe mailto:redhat-list-request redhat com?subject=unsubscribe
> > https://www.redhat.com/mailman/listinfo/redhat-list
> >
> 
> 
> --
> http://www.seekitzone.com
> http://www.e-securenetworks.net
> http://www.shopper-holic.com
> http://www.planet247.net
> http://www.auction-holic.com
-- 
Aly S.P Dharshi
aly dharshi uleth ca
Southern Alberta Digital Library Project
                                                                                                                             
        "A good speech is like a good dress
         that's short enough to be interesting
         and long enough to cover the subject"