MSRBL signature change

[Henrik K]

On Fri, Nov 07, 2008 at 08:39:01AM -0800, Bill Landry wrote:

> Luca Gibelli wrote:
> > Hello Paul,
> >
> >> At first, it seems to work, and I get a log message now and then like:
> >>   SubmitDetectionStats: No new detection records found
> >>   SubmitDetectionStats: Submitted 10 records
> >>
> >> But about 1 in 3 times, when fleshclam tries to submit them, it reports:
> >>
> >>   ERROR: SubmitDetectionStats: Permanent failure
> >
> > I examined the clamd.log that you sent me via private email and noticed
> > that you are using some third party sig. databases, including MSRBL:
> >
> > MSRBL-Images/0-0-wxYz.UNOFFICIAL FOUND
> >
> > This signature is causing a permanent failure because it doesn't follow
> > our naming standard: slashes are not allowed in signature names (although the
> > engine accepts them).
> >
> > We should probably contact MSRBL and ask them to modify their naming
> > scheme.
> >
> > Best regards
>
> I contacted Chris Burton via the MSRBL users list and he has replaced
> the slashes "/" in his signature files with a dot "."

FYI, you should replace..

header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images/}

->

header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images\b}


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
AMaViS-user@...
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/ 

[Mike Cappella-4]

Henrik K wrote:

> FYI, you should replace..
>
> header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images/}
>
> ->
>
> header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images\b}
>

... as well any @virus_name_to_spam_score_maps rules referencing
MSRBL-Images that includes a slash separator, such as those mentioned in
the recent thread:

  [AMaViS-user] SaneSecurity - new signature format.

In:

@virus_name_to_spam_score_maps =

    ...
    [ qr'^(MSRBL-Images/|MSRBL-SPAM\.)'            => 0.1 ],
    ...
change to:
    ...
    [ qr'^(MSRBL-(Images|SPAM)\.)'                 => 0.1 ],
    ...

or to:
    ...
    [ qr'^(MSRBL-Images\.|MSRBL-SPAM\.)'           => 0.1 ],
    ...

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
AMaViS-user@...
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/ 

[Mark Martinec-4]

Mike, Henrik, ...

> > FYI, you should replace..
> > header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images/}
> > ->
> > header L_AV_MSRBL_Img   X-Amavis-AV-Status =~ m{\bAV:MSRBL-Images\b}
>
> ... as well any @virus_name_to_spam_score_maps rules referencing
> MSRBL-Images that includes a slash separator, such as those mentioned in
> the recent thread:
>
>   [AMaViS-user] SaneSecurity - new signature format.
>
> @virus_name_to_spam_score_maps =
>     [ qr'^(MSRBL-Images/|MSRBL-SPAM\.)'  => 0.1 ],
> change to:
>>     [ qr'^(MSRBL-(Images|SPAM)\.)'      => 0.1 ],

Thanks, will do that for 2.6.2.

  Mark

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
AMaViS-user@...
https://lists.sourceforge.net/lists/listinfo/amavis-user 
 AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
 AMaViS-HowTos:http://www.amavis.org/howto/