[Avcheck] VIRUS REPORT

Marek Bialoglowy ultor@unijet.pl
Sat, 7 Dec 2002 01:05:05 +0700


Hello

When avcheck detects virus in e-mail from me it sends me message
from Postfix:

---------

This is the Postfix program at host mail.systemintegra.com.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

The Postfix program

<nospam@systemintegra.com>: service unavailable. Command output: Message
didn't
    pass the virus check: infected: EICAR-Test-File

---------

but I don't receive any message from 'infected' script. What should I change
to make postfix send warning to user receiving mail with virus and send back
some custom message to person who have sent it to account on my system (like
in Amavis) ?

root@mail:/etc/postfix# grep "avche" /etc/postfix/main.cf
content_filter=avcheck

master.cf

[...]

#        -f ${sender} -S :10025 -- ${recipient}
avcheck   unix  -       n n        -       5       pipe
  flags=q user=avclient argv=/var/spool/avp/avcheck
  -d  /var/spool/avp/./tst
  -s  AVP:/var/spool/avp/ctl/AvpCtl  -f ${sender}
  -S  :1025 -- ${recipient}

[...]

Thank you.

Best Regards,

 Marek Bialoglowy [Ultor@hert.org] - INFORMATION SECURITY CONSULTANT
 GROUP: HERT (www.hert.org) - PGP: http://www.hert.org/pgp/Ultor.asc
 JOB: System Integra -- Jakarta, Indonesia -- Timezone: JAVT, GMT +7