[clamav-users] [ext] What kind of mails is clam* checking? Only mails with attachments / mailflow

[Stefan Bauer]

Thank you!

Am Do., 7. Feb. 2019 um 14:25 Uhr schrieb Ralf Hildebrandt <
Ralf.Hildebrandt at charite.de>:

> * Stefan Bauer <cubewerk at googlemail.com>:
> > Dear Users,
> >
> > my mailflow is following:
> >
> > amavis -> 15-av_scanners ->
> >  ['ClamAV-clamd',
> >    \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
> >    qr/\bOK$/m, qr/\bFOUND$/m,
> >    qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
> >
> > What kind of mails are forwarded to clamd for scanning/checking?
>
> Usually ALL mails.
>
> > Or What kind mails are checked by clam*?
>
> Usually ALL mails.
>
> > Only mails with attachments?
>
> amavis decomposes the mail into it's text parts and attachments and
> usually scans the whose mail "as is" and the text parts and
> attachments sperately.
>
> > As clam* can also do URL checks and stuff, also mails withouth
> attachments
> > can be infected.
>
> --
> Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
> ralf.hildebrandt at charite.de        Campus Benjamin Franklin
> https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
> Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20190207/f715a112/attachment.htm>