Bend in the Weather

Many people use ClamAV with their Email server to filter out viruses. This is indeed a good idea!^(tm)

However, by default it doesn't pick up Scam, Phishing or even Malware Emails.

You can add some unofficial 3^rd party databases to beef up the amount of 'bad' data that ClamAV can detect.

•SaneSecurity produce a ClamAV database that holds such information.
•SecuriteInfo also creates a ClamAV database that contains information on Malware.
•MBL also produce lists in various formats, one of these is in ClamAV signature database format.

You can even automate the process easily by using a script to grab these lists at regular intervals (once per day is recommended). Throw it in cron to run once daily, and you're set.

You'll see something like this in your maillogs:

2008-05-08 01:41:14 1JtllZ-0002Ok-5x H=61-228-171-106.dynamic.hinet.net [61.228.171.106] F= rejected after DATA: This message contains a virus or other harmful content (Html.Spam.Gen2942.Sanesecurity.08040202.zip)

Whilst clamd reports it like:

Thu May 8 01:41:14 2008 -> /var/spool/exim/scan/1JtllZ-0002Ok-5x/1JtllZ-0002Ok-5x.eml: Html.Spam.Gen2942.Sanesecurity.08040202.zip FOUND

You'll be surprised at just how much it picks up, outside that of your usual spam/virus scanning and even greylisting processing.