Antivirus

This plugin is not a replacement for the mail scanning provided by ClamAV. All this plugin does is try and detect if a message contains a Microsoft executable file so you can score it appropriately.

This plugin performs simple anti-virus tests.

How it works

The MICROSOFT_EXECUTABLE rule works by checking for 3 possibilities in the message in any application/* or text/* part in the message:

  • in text parts, look for a uuencoded executable start string
  • in application parts, look for filenames ending in an executable extension
  • in application parts, look for a base64 encoded executable start string

Rules

Area Rule name Description Default scores
body MICROSOFT_EXECUTABLE Message includes Microsoft executable program 0.1
body MIME_SUSPECT_NAME MIME filename does not match content 0.1

Settings

This plugin has no additional settings. It can be enabled or disabled under Warden -> Settings -> Plugin Settings -> AntiVirus.

Related Pages