Thanks! That worked. I had the heuristics settings too strict in the CLAMD.conf file. Once I changed these the message was delivered.
Is there any way I can restore an incorrectly Clamwall-filtered message from the .101 file it creates when it strips the message and turn it back into a message?
If needed, please reply directly to normang at normie.com
Thank you!
-Norman
You need to do two things:
1. Rename the file to '8.3' format with an extention of '.cnm' (e.g 'mail0001.cnm')
2. Use a text editor (like Notepad) to remove the initial lines containing Mercury routing information. They consist of '$$', 'T destination' and a blank line. The message will then begin with a line probably starting 'Return-path:'
This message can then be placed into a destination mailbox where it will be seen as new mail. (I always keep a copy just in case.)
I have a small program which combines the .txt and .101 files and does this move automatically if you are interested.
[quote user="dilberts_left_nut"]The .101 file can be dropped back into the queue dir and will be reprocessed.
[/quote]
Only if renamed using a 8.3 filename.
[quote user="dilberts_left_nut"]The .101 file can be dropped back into the queue dir and will be reprocessed.
[/quote]
Even after changing the filename (as Thomas says), it will likely be blocked again unless the signatures have been corrected or the Clamwall restrictions have been relaxed.
It all depends on what caused the incorect filtering in the first place. I always put false positives into an admin account.
Yes, I was going to add that, but I was in a hurry [:)]
I was just making the point that it is saved as a .101 file so it CAN be re-injected into the queue after being inspected / fixed or filtering turned off temporarily.
[quote user="PaulW"]
You need to do two things:
1. Rename the file to '8.3' format with an extention of '.cnm' (e.g 'mail0001.cnm')
2. Use a text editor (like Notepad) to remove the initial lines containing Mercury routing information. They consist of '$$', 'T destination' and a blank line. The message will then begin with a line probably starting 'Return-path:'
This message can then be placed into a destination mailbox where it will be seen as new mail. (I always keep a copy just in case.)
I have a small program which combines the .txt and .101 files and does this move automatically if you are interested.
[/quote]
Is this process still true for Mercury v 4.62? I've tried changing the message and turning off clamwall filtering and the message just sits in the queue.
The .txt file says
Virus : Heuristics.Structured.CreditCardNumber
BanExt:
To put the file back in the queue for delivery you should keep the .101 extension but shorten the name part to 8 characters. If you want to move it directly to a mailbox follow PaulW's instruction.
The virus definitions are not in Clamwall but in ClamAV. I don't think you can edit the virus definitions, but there are lots of settings in the configuration file that can be tailored to suit your requirements.
/Rolf
