Re: Multiple malware scanners

You can do this with a custom command line running a script, but that misses 
out Exiscan's native support for various daemons.

I like the idea of specifying which scanner in the ACL entry, as you could 
deal with the known viruses in your favourite scanner first, and deal with 
suspect attachments that get past that with backup scanner(s).

Something like:-

acl_check_mime:
..
warn  set acl_m1  = ${extract{-1}{.}{${lc:$mime_filename}}}
warn log_message = Executable Attachment ($acl_m1) - $mime_filename
     condition   = ${if \ 
match{$acl_m1}{\N^(vbs|vbe|wsf|wsh|js|jse|exe|com|cmd|shs|hta|bat|scr|lnk|pif)$\N}{1}{0}}
     set acl_m3  = $acl_m1

acl_check_content:
..

deny message = This contains $malware_name
  log_message = stopped $malware_name
  malware = * : sophie

deny message = This contains $malware_name
  log_message = $malware_name got past Sophie!
  condition = ${if !eq{$acl_m3}{} {1}{0}}
  malware = * : clamav

deny message = This contains a potentially executable ($acl_m3) attachment
  condition = ${if !eq{$acl_m3}{} {1}{0}}

..

The idea is you get a bit more warning about new viruses (or ones your main 
scanner doesn't spot!).

Chris

On Tue, 17 Aug 2004 16:00:47 +0100 Mike Grice <[email protected]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Peter Bowyer wrote:
> | What chance of supporting multiple malware scanners in one instance of
> | Exiscan? I have a requirement to scan twice with different scanners -
> | currently I have to do the first with Exiscan and hand the second off to a
> | router with obvious pitfalls.
> |
> | I would want to select which malware scanner gets called for each ACL so I
> | guess
> |
> | malware = *:sophie
> |
> | malware= *:clamav
> |
> | etc
> |
> | .. and a new way of defining the calling parameters of each.
> 
> Could you do it with a macro with a router that calls a pipe?
> 
> Mike
> - --
> |Mike Grice                  Broadband Solutions for
> |Operations Support Analyst        Home & Business @
> |PlusNet plc                            www.plus.net
> +------ PlusNet - The smarter way to Internet! -----
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> 
> iD8DBQFBIh2fHutxUiaMc3URAgjtAJwOkWuSzzJDDia8ZBZCEHuMPIyWqgCeMgH4
> hbyQWKK5XnvBJnbFlSKvQuU=
> =yXRQ
> -----END PGP SIGNATURE-----
> 
> 
> 

--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+--
Christopher Wakelin,                                [email protected]
IT Services Centre, The University of Reading,       Tel: +44 (0)118 378 6630
Whiteknights, Reading, RG6 2AF, UK                   Fax: +44 (0)118 975 3094