"SfR Fresh" - the SfR Freeware/Shareware Archive

Member "build/spamassassin/doc/Mail_SpamAssassin_Plugin_AntiVirus.html" of archive SpamAssassin-3.2.3.5-win32-src.zip:


Caution: In this restricted "SfR Fresh" environment the current HTML page may not be correctly presentated and may have some non-functional links. Alternatively you can here view or download the uninterpreted source code. That can be also achieved for any archive member file by clicking within an archive contents listing on the first character of the file(path) respectively on the according byte size field.


NAME

AntiVirus - simple anti-virus tests


SYNOPSIS

  loadplugin     Mail::SpamAssassin::Plugin::AntiVirus
  body MICROSOFT_EXECUTABLE eval:check_microsoft_executable()
  body MIME_SUSPECT_NAME    eval:check_suspect_name()


DESCRIPTION

The MICROSOFT_EXECUTABLE rule works by checking for 3 possibilities in the message in any application/* or text/* part in the message:

- in text parts, look for a uuencoded executable start string
- in application parts, look for filenames ending in an executable extension
- in application parts, look for a base64 encoded executable start string