Below is a running archive of our news items. For the most recent posts, please click here to view them on the home page.

24/9/2006 - Released beta 4.56.6. This is the last main release before next weekend's stable release.
8/9/2006 - Released beta version 4.56.3. Please read the ChangeLog for details of all the new features and changes.
21/8/2006 - Just to verify the situation with Sys::Syslog. I have worked around the compatibility reasons in Sys::Syslog-0.17 and the current release of MailScanner does indeed use 0.17 and installs successfully, and all works.
7/8/2006 - Updated the stable release to include downgrading Sys::Syslog from 0.17 to 0.16 as the author of this module has withdrawn 0.17 due to incompatibility reasons.
1/8/2006 - Released new stable version 4.55. There are many new features and improvements in this release. Please see the Change Log for details.
23/7/2006 - Released beta 4.55.8. This should be the last beta before the next stable release.
24/6/2006 - Released beta 4.55.7. Fixed bug in "--changed" when Custom Functions being used.
23/6/2006 - Released beta 4.55.6. New "--changed" command-line switch to print out non-default MailScanner.conf settings and other changes, improvements and minor fixes. See the Change Log for more details as usual.
17/6/2006 - Released beta 4.55.4. Better use of syslog, more documentation included, Sophos version 5 installer improvements.
8/6/2006 - Released new beta release with the correct Lock Type behaviour in Linux, ie. posix and not flock.
8/6/2006 - Discovered error in comments in MailScanner.conf. If you are using sendmail version 8.13.0 or above on Linux, you must set "Lock Type = posix" in MailScanner.conf. To find the version of sendmail you are using, run the command "/usr/sbin/sendmail -d0.1 -bt ".
5/6/2006 - Upgraded easy-to-install ClamAV + SpamAssassin package to contain SpamAssassin 3.1.3.
1/6/2006 - Release of beta 4.55.1. Improved auto-configuration support, among other things. See the Change Log for details.
25/5/2006 - Release of stable 4.54.6. This is to get rid of all the issues with 4.53. Next release won't be until July or August. See the Change Log for details.
23/5/2006 - Several important announcements: Stables releases will now normally be done on the 1st of every other month, so 1 every 2 months not 1 every month. People who can beta-test releases for me, please join the mailscanner-beta@lists.mailscanner.info mailing list. Released beta version 4.54.4. This is the first edition for the beta-testing programme.
11/5/2006 - Released beta version 4.54.2. Several bugs fixed that were introduced in 4.53, sorry about that. Many Perl modules have been updated to their latest releases wherever there have been major updates or improvments.
8/5/2006 -Released beta version 4.54.1. I have added support for Sophos Version 5. Please test this and let me know what you think.
5/5/2006 -Released stable version 4.53.8. Many apologies, there has been discovery of a bug in the phishing net which may cause problems on some systems. Unfortunately this bug was not detected during beta testing. It warrants the publication of a new "stable" release, I am very sorry to have to do this to you.
3/5/2006 -Released stable version 4.53.7. I have commented out the setting of "SpamAssassin Local State Dir" in MailScanner.conf as this is causing some problems on sites which block all outbound network traffic by default, causing "sa-update" to fail, which then causes SpamAssassin serious grief.
1/5/2006 -Released stable version 4.53.6. There are several new features this month, including customisation of the response to Web Bugs. There is also support for the "sa-update" command provided with new versions of SpamAssassin, and support for numerical IP addresses in the list of safe phishing sites, so that complete servers can be whitelisted rather than having to whitelist every single domain that is served. Please see the Change Log for more information and details.
27/4/2006 -Released beta version 4.53.5. There are quite a few new features here, please try it for me before 1st May when I will do the next stable release. Numeric IP addresses are allowed in the phishing net safe sites list. Some filenames can be ignored by the Web Bug detector, and several other new things. Please read the Change Log for more information and details.
25/4/2006 -Released beta version 4.53.4. This includes support for the latest Exim 4.61 and filename and filetype checking of gzip-ed files.
15/4/2006 -Released beta version 4.53.2. This improved disk space detection in potential DoS attack checker. It won't happen in a default installation, but only when you start unpacking RAR archives that have huge expansion ratios and you are using tmpfs for /var/spool/MailScanner/incoming.
6/4/2006 -Updated easy-to-install package of ClamAV and SpamAssassin to contain the latest version of ClamAV, 0.88.1.
1/4/2006 -Released stable version 4.52.2. Virtually no changes from the last beta.
25/5/2006 - Release of stable 4.54.6. This is to get rid of all the issues with 4.53. Next release won't be until July or August. See the Change Log for details.
23/5/2006 - Several important announcements: Stables releases will now normally be done on the 1st of every other month, so 1 every 2 months not 1 every month. People who can beta-test releases for me, please join the mailscanner-beta@lists.mailscanner.info mailing list. Released beta version 4.54.4. This is the first edition for the beta-testing programme.
11/5/2006 - Released beta version 4.54.2. Several bugs fixed that were introduced in 4.53, sorry about that. Many Perl modules have been updated to their latest releases wherever there have been major updates or improvments.
8/5/2006 -Released beta version 4.54.1. I have added support for Sophos Version 5. Please test this and let me know what you think.
5/5/2006 -Released stable version 4.53.8. Many apologies, there has been discovery of a bug in the phishing net which may cause problems on some systems. Unfortunately this bug was not detected during beta testing. It warrants the publication of a new "stable" release, I am very sorry to have to do this to you.
3/5/2006 -Released stable version 4.53.7. I have commented out the setting of "SpamAssassin Local State Dir" in MailScanner.conf as this is causing some problems on sites which block all outbound network traffic by default, causing "sa-update" to fail, which then causes SpamAssassin serious grief.
1/5/2006 -Released stable version 4.53.6. There are several new features this month, including customisation of the response to Web Bugs. There is also support for the "sa-update" command provided with new versions of SpamAssassin, and support for numerical IP addresses in the list of safe phishing sites, so that complete servers can be whitelisted rather than having to whitelist every single domain that is served. Please see the Change Log for more information and details.
27/4/2006 -Released beta version 4.53.5. There are quite a few new features here, please try it for me before 1st May when I will do the next stable release. Numeric IP addresses are allowed in the phishing net safe sites list. Some filenames can be ignored by the Web Bug detector, and several other new things. Please read the Change Log for more information and details.
25/4/2006 -Released beta version 4.53.4. This includes support for the latest Exim 4.61 and filename and filetype checking of gzip-ed files.
15/4/2006 -Released beta version 4.53.2. This improved disk space detection in potential DoS attack checker. It won't happen in a default installation, but only when you start unpacking RAR archives that have huge expansion ratios and you are using tmpfs for /var/spool/MailScanner/incoming.
6/4/2006 -Updated easy-to-install package of ClamAV and SpamAssassin to contain the latest version of ClamAV, 0.88.1.
1/4/2006 -Released stable version 4.52.2. Virtually no changes from the last beta.
 
>>> MORE <<<
25/3/2006 Released beta version 4.52.1. I have implemented a less strict mode of operation for the phishing net. With "Use Stricter Phishing Net = no" it will only check the end of the domain name starting from the name of the company of organisation owning the domain. It knows how much to check depending on which country the domain is in. This will still protect against virtually all phishing attacks excepe for the rare cases where a host within the company is subverted for use in the phishing scam.
24/3/2006 I am intending to upgrade the phishing net so that it has a less strict mode of operation. There is a file http://spamcheck.freeapp.net/two-level-tlds which is plain text and lists all the top-level domain names and all the second-level domain names used by every country to name categories of sites in their respective countries. If these parts of the domain name match, and the next name from the right, then we accept the link as valid.
8/12/2004 Released beta version 4.37.1. This now supports split sendmail incoming queue directories, where any mqueue.in can have qf, df, xf, tf subdirectories, each of which contains the relevant file for each message. This will greatly speed operation on systems with very big incoming queues, and also allows xf and tf files to be mounted on tmpfs for extra speed.
1/12/2004 Released stable version 4.36.4. This has many improvements in the phishing net, and many improvements and changes in other areas. See the Change log.
30/11/2004 Released beta version 4.36.3. This has more improvements in the phishing net, and many other changes. See the Change log.
18/11/2004 Released beta version 4.36.1. This has many improvements in the phishing net, and also supports RedHat Enterprise 4.
4/11/2004 Released version 4.35.11. This appears to have fixed the RedHat up2date problems that have been experienced on some RedHat systems. It is currently available in RedHat/Mandrake/RPM, SuSE and Solaris/Other Unix forms. This has been tested on RedHat Enterprise, CentOS, SuSE and others.
1/11/2004 Released stable version 4.35.9. Main new features this month are the "phishing" fraud detector and support for Mandrake Linux. The are quite a few other changes and improvements as well, please see the Change log for more information.
27/10/2004 Released beta version 4.35.7. Messages with null MIME boundaries are now handled properly, and viruses in them properly detected.
26/10/2004 Released beta version 4.35.6. Fixed bug where messages with a null MIME boundary are passed. They are now rejected as unparsable.
21/10/2004 Released beta version 4.35.5. Added support for ClamAV 0.80 and clamavmodule version 0.12. Dropped support for older versions of ClamAV and clamavmodule. Other changes as well.
11/10/2004 Released beta version 4.35.4. A new feature in this beta, a "phishing" fraud detector. If you don't know what phishing fraud is, ask Google. This alerts you to attempts to defraud you out of personal information and bank details, for example. Other changes as well.
10/10/2004 Released beta version 4.35.1. I think I have cracked the problems with dependencies on RPM systems with perl-MIME-Base64. Other changes as well.
1/10/2004 Released stable version 4.34.8. New changes this month include a generic "roll your own" virus scanner, the ability to delete specific headers from messages (so you can kill off "Read Receipts") and you can now bounce spam messages as attachments if you really have to do this. Many other changes as well.
28/9/2004 Released another beta version, 4.34.7. I have implemented a "generic" virus scanner, which you write yourself in a script or program which is called by the "generic-wrapper" script. The spec of the output required by your program is in the "generic-wrapper" script. It's very simple.
27/9/2004 Released another beta version, 4.34.6. Unless anything is wrong with this, it will form the basis of the next stable release in a few days time.
22/9/2004 SpamAssassin 3.0.0 has been released. MailScanner supports this release just fine, and I have updated the ClamSA+SpamAssassin package in the "Other Stuff" area of the MailScanner downloads page.
18/9/2004 Released beta 4.34.4. Have added "Bounce Spam As Attachment" option to senders of wrongly-tagged spam can see what message was caught. Only useful to people whose pointy-haired bosses think bouncing spam is a good idea :-(
16/9/2004 Released beta 4.34.3 to fix MIME-Base64 package problems.
15/9/2004 Released beta 4.34.2 to test out new MIME-tools and MIME-Base64 packages.
14/9/2004 Released updated package for ClamAV and SpamAssassin 3.0.0-RC5.
10/9/2004 Released beta 4.34.1 to test out new MIME-tools and MIME-Base64 packages.
10/9/2004 Released updated package for ClamAV and SpamAssassin 3.0.0-RC4.
6/9/2004 Released installation package for ClamAV, the ClamAV perl module, and SpamAssassin 3. There are install scripts in the package for both RPM-based and non-RPM systems. And yes, you can skip the installation of ClamAV itself if you already have it installed from somewhere else.
1/9/2004 Released stable version 4.33.3-1. No really major changes this month, just a collection of minor improvements and a few fixes. Please see the ChangeLog for details.
1/8/2004 Released stable version 4.32.5-1. Major changes this time include fixes for MyDoom-0 problems, "Spam Score Number Format" option, "Run In Foreground" option and "--version" command-line switch to report all module versions to aid debugging and list postings. Please see the ChangeLog for details.
27/7/2004 Released beta version 4.32.4-1. This should fix the problems with MyDoom-O.
22/7/2004 Released beta version 4.32.3-1. Please see the ChangeLog for details.
10/7/2004 Released beta version 4.32.2-1. Please see the ChangeLog for details.
1/6/2004 Released stable version 4.31.4-1. New install.sh script for non-RPM systems to greatly ease installation, updated support for various virus scanners and SuSE 9.1, and fixed some problems such as file modification when signing quoted-printable PDF attachments. Various other bug fixes and many updates, see the ChangeLog for details.
26/5/2004 Released unstable version 4.31.3-1. Various bug fixes, including one for Postfix 2.1 users on some old versions of Perl, and many updates and improvements to the install.sh for non-RPM systems.
22/5/2004 Released unstable version 4.31.2-1. Updated support for new virus scanners, can now detect and disarm "web bugs", reports can contain %variables%. Other changes as well, please see the ChangeLog.
2/5/2004 Released minor update. Fixed problem in previous release were Net::CIDR would not always install properly on RPM-based systems, and moved default installation location of BitDefender to /opt/bdc.
1/5/2004 Released stable version 4.30.3. More improvements to MIME decoding and zip-file handling. See the Changelog for full details.
25/4/2004 Released unstable version 4.30.2-1. Pre-release for 4.30. Please report any problems. See the Changelog for full details.
14/4/2004 Released unstable version 4.30.1-1. Added support for SpamAssassin V3 and AVG scanner. Another MIME decoding improvement. Zip files can now be found by either content or name. See the Changelog for full details and a list of the other changes.
1/4/2004 Released stable version 4.29.7-1. Lots of updates this time for multi-layered defences against all the tactics in use by the virus writers, and some reliability, robustness and speed improvements. See the Changelog for full details. In March, we had over 23,000 downloads and were accessed from over 70,000 different sites.
25/3/2004 Released unstable version 4.29.6-1. Zip files are now detected by content and not just name. Fix to Bayes regular rebuilding code, so it should now report any errors that caused it to fail. Various logging improvements.
23/3/2004 Released unstable version 4.29.5-1. Added BinHex decoder and facility to have a directory full of Custom Functions to make upgrading easier. Old version of this facility (CustomConfig.pm) is still present as well.
22/3/2004 Released unstable version 4.29.4-1. Fixed bugs in Postfix compatibility and MCP message delivery problems.
18/3/2004 Released unstable version 4.29.3-1. Fixed bug in handling of messages with several attachments, and can now unpack self-extracting Zip archives.
18/3/2004 Released unstable version 4.29.2-1. Now detects nasty emails generated by Bagle.Q worm.
16/3/2004 Released unstable version 4.29.1-1. Fix for passing archives through properly when allowing all password-protected archives. Minor speed-ups. Expect to see "defunct" processes appear with this version, it is quite normal.
8/3/2004 Released stable version 4.28.6-1. Fixed problem for Debian users with files in the queue directory. Possible speed improvement as well.
5/3/2004 Released stable version 4.28.5-2. Slight error which might stop RPM distributions installing properly.
5/3/2004 Released stable version 4.28.5. This version can block password-protected zip files, and can unpack zip files to apply file name and content rules (as well as virus scanning) to their content. If you use the RPM distributions, then all required Perl modules will automatically installed for you when you run the "./install.sh" script. If you use the tar distribution, then please see the documentation for information about what Perl modules are needed. Please also read the ChangeLog.
3/3/2004 Released unstable version 4.28.3. I have re-written the zip analyzing code to a large extent, and there is now a new keyword in the "Silent Viruses" list called "Zip-Password". Adding this to your Silent Viruses list will stop notifications about these being sent to the (possibly fake) sender of the file. You will still need to install the Perl modules Compress::Zlib and Archive::Zip yourself before using this version.
2/3/2004 Released unstable version 4.28.2. This version can detect password-protected zip files and optionally block them. You will still need to install the Perl module Archive::Zip yourself before using this version.
1/3/2004 Released unstable version 4.28.1. This version can read zip files so you can apply filename rules in there. Note: You will have to install the Perl module Archive::Zip yourself before this version will run.
1/3/2004 Released stable version 4.27.7. Since 4.26, the most important improvements are those that I have made to the MIME decoder, which is a lot more robust than it was. See the ChangeLog for everything else.
25/2/2004 Released unstable version 4.27.5. Improved robustness of MIME decoder, added support for Symantec CarrierScan and some other things.
21/2/2004 Released unstable version 4.27.4. Added "non-spoofing" virus list and a few other things.
12/2/2004 Released unstable version 4.27.2. MIME message decoder is now considerably more robust and aggressive than in all previous versions.
11/2/2004 Released unstable version 4.27.1. Various improvements and fixes, including the restoration of the "bounce" spam action.
2/2/2004 Released stable version 4.26.8. There is now a workaround for a Solaris problem, please set "Rebuild Bayes Every = 0" on Solaris systems.
31/1/2004 Released stable version 4.26.7. Please see the ChangeLog for details on what is new in this release.
29/1/2004 Released beta 4.26.6. This is a test release before I do a stable release this weekend. See the ChangeLog for details on what has changed.
23/1/2004 Removed the "bounce" spam action. Added automatic schedules Bayes database rebuilding. Added logging of non-spam. Added "notify" spam action to tell users they received some spam without letting them see it directly. See the ChangeLog for more details.
9/1/2004 Fixed outstanding Postfix problems and a few other minor issues. Please can you try this out? See the ChangeLog for more details.
18/12/2003 Fixed a few bugs in the MCP (Message Content Protection) code. There is a little bit of documentation for MCP now too.
2/12/2003 Fixed a bug causing doubling up of subject lines if they are "sanitised". Also has Infinite-Monkeys removed from the supplied "Spam List" setting. Please see the ChangeLog for more details.
29/11/2003 Released new stable version 4.25-11. Many new features, including defence against "spam zombies" and other systems sending mail to you in very high volumes as part of an attack. Please see the ChangeLog for more details.
18/11/2003 Released new unstable beta version 4.25-9. Hopefully fixed the Maximum Message Size bug. This is getting very close to release so please test it for me!
15/11/2003 Released new unstable beta version 4.25-8. Fixed a bunch of bugs in 4.25-7.
14/11/2003 Released new unstable beta version 4.25-7. Added support for ClamAV Perl module to speed up ClamAV scanning. Fixes a few bugs. See the ChangeLog for details on what else is new in this release.
7/11/2003 Released new unstable beta version 4.25-6. Added ClamAV parsing improvements and the ability to change the user, group and permissions of files and directories within "Incoming Work Dir" and "Quarantine Dir". See the ChangeLog for details on what else is new in this release.
1/11/2003 Released new unstable beta version 4.25. I didn't think it was worth doing a full release, there is some new code that provides support for LDAP directory servers, and this code has not been thoroughly tested yet. See the ChangeLog for details on what else is new in this release.
6/10/2003 Released new stable version 4.24. Loads of improvements, please see the for details.
1/10/2003 Released test release 4.24-4. This is unlikely to change much before it is released as a stable version in the next few days. See the ChangeLog.
13/9/2003 Updated Debian package now available. One of the main maintainers of Debian packages has taken over the job of looking after the MailScanner Debian package, and has released it here.
1/9/2003 Released update 4.23-11. This fixes a few mistakes and an important logging bug present in 4.23-10.
31/8/2003 Released stable version 4.23-10. Loads of new features and improvements this time. Far too much to mention here, so please see the "ChangeLog".
28/8/2003 Released beta version 4.23-8. Various fixes, including the Denial-of-Service attack handling bug. Please see the "ChangeLog" for more details.
21/8/2003 Released beta version 4.23-7. Improved RAV handling in several ways, and added new "Virus:" in addition to "To:", "From:" etc in rulesets. Please see the "ChangeLog" for more details. If you are interested in content filtering, please contact me and I'll fill you in.
12/8/2003 Released beta version 4.23-5. Fixed problems in RAV handling and corrected the show-stopper in the beta version I released last night. Sorry about that folks! Please see the "ChangeLog" for more details.
11/8/2003 Released beta version 4.23-3. Most important change is that all necessary installation directory choice has been moved out of the -wrapper and -autoupdate scripts into virus.scanners.conf. Please see the "ChangeLog" for more details.
8/8/2003 Released beta version 4.23-2. Added support for eTrust virus scanner, and greatly improved flexibility of "Allowed Sophos Error Messages". Please see the "ChangeLog" for more details.
7/8/2003 Released beta version 4.23-1. Please see the "ChangeLog" for more details.
3/7/2003 Released stable version 4.22-5. "Spam List" configuration option had to list all the RBL's in lower case. Now fixed. Also improved efficiency of filetype checking.
1/7/2003 Released stable version 4.22-4. Some useful new features added this month, including true detection of file content type regardless of filename, the ability to ban HTML forms in messages and the ability to limit the maximum size of any message (on a per-user basis of course). For more details, please see the ChangeLog.
23/6/2003 Released beta version 4.22-3. This includes support for checking file contents regardless of the attachment filename. It also includes HTML <FORM> tag detection.
4/6/2003 I am presenting MailScanner to other computer security professionals at a CERT conference in London tomorrow.
2/6/2003 Released stable version 4.21-9. Bugfix in new "attachment" spam action.
1/6/2003 Released stable version 4.21-8. Mostly bugfixes since 4.21-6, but see the ChangeLog.
18/5/2003 Released beta version 4.21-6. This includes a new "spam action" called "attachment" which moves the entire message into an attachment and puts a warning in the original message body saying what happened. This stops web bugs working in spam messages. There are also several Postfix fixes making it a lot more reliable.
11/5/2003 Last month, MailScanner was downloaded for the 100,000th time since I started counting. Quite a milestone!
3/5/2003 RPM distribution users: if you get an "unknown user" error when you start up MailScanner using the init.d script, then download an updated /etc/rc.d/init.d/MailScanner or just edit it and put a "#" at the start of the line that mentions "smmsp".
3/5/2003 Released version 4.20-3. One fix to the Postfix+ZMailer code which you will need if you archive or quarantine any mail.
2/5/2003 Released version 4.20. Most important improvements for this release are support for Postfix and ZMailer systems. Lots of other improvements and a few fixes, see the ChangeLog for more detailed information.
26/4/2003 Released beta-test version 4.15-9. Various minor Postfix issues fixes, improved error reporting. RedHat "init.d" script improved to handle Postfix, sendmail and Exim setups. "Archive Mail" setting can now also write directly to mbox-format mailboxes.
19/4/2003 Released beta-test version 4.15-5. No critical changes, it will now spread files across the postfix/incoming tree more evenly, and is more robust if sent bad files by Postfix. "Advanced SpamAssassin Settings" are now documented as these will be needed by Postfix users.
17/4/2003 Released beta-test version 4.15-4. Fixed a couple of important Postfix bugs. There is also a slight (but important) change to the installation guide for Postfix support for the "defer_transports" setting.
13/4/2003 Released beta-test version 4.15-2. This contains support for Postfix and ZMailer. It also includes the new f-prot-wrapper which is needed if you are running F-Prot on a ramdisk or with tmpfs. I have even written you a little installation guide for Postfix support.
9/4/2003 To get McAfee working on RedHat 9, you must add the line "export LD_ASSUME_KERNEL=2.2.5" to the /usr/lib/MailScanner/mcafee-wrapper script. Then it won't hang.
5/4/2003 RaQ3 systems and sendmail 8.9 users only – if you are having problems starting or stopping MailScanner 4.14, replace /etc/rc.d/init.d/MailScanner with this file.
4/4/2003 Released version 4.14. This includes support for F-Prot 3.13, F-Secure 4.50 and SpamAssassin 2.53, and various other tweaks and improvements.
29/3/2003 1. F-Prot 3.13 has been released, and they have changed the output format again. Here is a new version of the "sub ProcessFProtOutput" in SweepViruses.pm. Look for the line that says "sub ProcessFProtOutput {" and replace it (and the code up to the start of the next function) with the new file.
2. New beta release 4.14-8 incorporating support for the SAVI Perl module which uses Sophos Anti-Virus but without all the startup time overhead of calling "sophos-wrapper" or "sweep". Installation notes for the SAVI Perl module itself are in the docs/install directory.
27/3/2003 Released 4.14-7 for beta-testing. Note this is only for testing purposes.
25/3/2003 Released 4.14-6 for beta-testing. Note this is only for testing purposes. I have run it with SpamAssassin 2.52 and it should be okay.
New: FreeBSD port available for download.
17/3/2003 Released 4.14-5 for beta-testing. Note this is only for testing purposes. The remaining problems with SpamAssassin 2.50 have been fixed. You will need to install SpamAssassin 2.60-CVS to get all the fixes, but it must not be a version downloaded before today, as their fix was only put in SpamAssassin last night.
7/3/2003 Problems with SpamAssassin 2.50 have mostly been fixed now. Either use SpamAssassin 2.60(CVS), or even better use SpamAssassin 2.51 if that has been released by the time you read this.
1/3/2003 Release version 4.13-3. RPM packaging problem in 4.13-1 and -2.
Remember: if you are upgrading then try out my upgrade_MailScanner_conf script. It will make your life a whole lot easier!
1/3/2003 Release version 4.13-1. The highlights are:
  • Script to automate upgrade of MailScanner.conf files
  • Customisation of system administrator notices improved
  • Option to ignore some Sophos error messages when scanning files
  • Option and Custom Function added to enable SQL logging
  • Options to block encrypted (or unencrypted) messages
  • Improved check_mailscanner script
  • Improved stripping of HTML to plain text
  • New Nod32 and Kaspersky updaters. F-Prot updater improved
24/2/2003 SpamAssassin 2.50 was released a few days ago. Unfortunately there is a small bug in it which hits MailScanner really badly. I have made a small patch available which fixes it. To install it, do this:
tar xzf Mail-SpamAssassin-2.50.tar.gz
patch -p0 < SA2.50.patch
cd Mail-SpamAssassin-2.50
perl Makefile.PL
make
make test # This step is optional, but a good idea
make install
23/2/2003 Joe Quinn has very kindly written an Installation Guide for Cobalt RaQ4 Systems.
15/2/2003 The awkward part of upgrading to the latest MailScanner release is inserting the new configuration parameters into your MailScanner.conf file. So here is a tool to apply all the updates for you. The only thing it will have trouble with are parameters that are commented out in the new MailScanner.conf file, such as "Run As User" and "Run As Group", so you will still need to check those yourself. But it will do 99% of the job for you. Let me know how you get on with this, and if you have suggestions for improvements to it. It will be included in the next release.
1/2/2003 Released version 4.12-2. I missed the kavdaemonclient-wrapper out of the RPM distributions.
1/2/2003 Released version 4.12-1. The highlights are:
  • "Hide Incoming Work Dir in Notices" configuration option
  • "X-MailScanner-Information:" header to all messages
  • "Notice Signature" configuration option
  • "Allow Partial Messages" configuration option
  • "Allow External Message Bodies" configuration option
  • "Detailed Spam Report" configuration option
  • Custom functions to implement per-domain spam whitelists and blacklists
  • Support for the Kasperksy daemon scanner
30/1/2003 Security: There is a new attack against Microsoft Outlook Express that is being exploited. It relies on very long filenames, so is very easy to block. Edit your filename.rules.conf file, and add a "deny" rule at the top of the file that has the pattern ".{150,}". Remember to add the logging text messages as well, and that all the 4 fields on the line must be separated with tab characters and not just spaces.
8/1/2003 There is now an on-line store selling goodies with MailScanner logos. If there are any other products you would like to see, or have ideas for better "captions" then please tell me and I will see what I can do.
1/1/2003 Released versions 3.27-1 and 4.11-1. The only change in 3.27 is the security fix described below. There are many improvements, changes and fixes in 4.11, of which these are a few highlights:
  • Security fix below is included
  • Modify Subject: line to show a message has been scanned
  • Stop MailScanner replying to mailing lists that send it viruses
  • Quarantine-cleaning script included
  • Virus scanner update cron job replaced by global updater script
  • Full installation instructions for FreeBSD
  • Improved AntiVir, Sophos, F-Prot and F-Secure parsers
See the Changelog for more details.
1/1/2003 In the spirit of Perl tradition, there is now a MailScanner poetry page. All contributions welcome!
18/12/2002 Important Security Fix: you must add "-OPrivacyOptions=noetrn" to the command-line of the incoming sendmail process (the one with the "-bd" option). On a heavily loaded server, this omission can be exploited maliciously to evade MailScanner.
New distributions of versions 3 and 4 will appear in the next day or two, containing this fix.
This will only happen on servers under heavy load, and when messages are in the incoming queue (mqueue.in) for a long time because your MailScanner server is not coping with the high mail load.
17/12/2002 1 in every 200 emails is infected with a virus. If you were wondering if you needed Mailscanner, the answer is a definite Yes!
8/12/2002 Dale Lovelace has put together a great MailScanner-MRTG package to provide you with a quick and easy way of monitoring your MailScanner servers.
3/12/2002 Version 4.10-1 released. This contains numerous additions, changes and fixes. The biggest changes are the inclusion of Exim support, and the addition of a package for SuSE Linux 8.0/8.1.
Please read the ChangeLog for a complete list of all the details.
I now also accept donations paid by credit card.
3/11/2002 Versions 4.05-3 and 3.26-2 released. This improves the Kaspersky output parser to handle their latest (poor) output format.
3/11/2002 Versions 4.05 and 3.26 released. This improves the handling of attachments whose filenames are in unknown character encodings, and improves the handling of attachments whose filenames look malicious, removing a potential security problem before anyone else finds it or exploits it. Neither of these have ever been intentionally exploited.
Version 4 only:
- Can now put "$filename" in inline warning messages to give a comma-separated list of the infected attachment filenames.
- Improvement to Trend parser when scanning archives.
- Improvement to ClamAV parser for multi-CPU servers.
- Added Dutch and Brazilian Portugese reports.
- Added an "End" function to the Custom Functions usable in the main conf file.
- NOTE: If you have added your own Custom Functions to CustomConfig.pl, you will need to add an "End" function for each of them.
27/10/2002 Versions 4.04 and 3.25 released. This fixes a potential Denial of Service attack. Note that this has never been intentionally exploited, but it is better to fix the problem before it is used.
If you are using version 3 and either do not want to upgrade at all, or have problems installing the new release, it is just a 1 line change to disinfect.pl.
27/10/2002 Version 4.03 released. This adds the ability for you to be able write your own functions to calculate values for configuration options. Read the comments at the top of mailscanner.conf and in CustomConfig.pm, which are in the distribution.
Support for Trend VirusWall added, bringing the total number of scanners to 14. Contributed by Martin Lorensen .
I have also improved the RPM install.sh script some more. And the bug in the sophos-autoupdate script is fixed.
26/10/2002 I have just installed MailScanner 4 on a RaQ 3, and had an "interesting" time. If you have problems doing this, read my FAQ article on the subject. If you have any more experiences with RaQ systems you would like to share, please let me know so I can add to the FAQ.
26/10/2002 Sophos have changed the file structure of their distributions, so after upgrading to 3.62 or 3.63 you may find that sophos-autoupdate doesn't work properly and you get "Missing main virus data" errors when you try to use Sophos. I have improved the sophos-autoupdate script to handle this. The new version will be included in the next release.
25/10/2002 Warning about "FriendGreetings.com" email spamming program: This isn't actually a virus, but if you don't read the entire licence agreement and then click "Yes", your PC will start spamming everyone in your Outlook address book. If you use SpamAssassin, you can easily protect yourself against this by adding 3 lines to the spam.assassin.prefs.conf file in the same directory as your MailScanner configuration files. Add these lines and then either wait a few hours or restart MailScanner:
header   FRIEND_GREETINGS   Subject =~ /you have an E-Card from/i
describe FRIEND_GREETINGS   Nasty E-card from FriendGreetings.com
score    FRIEND_GREETINGS   100.0
23/10/2002 Released 4.02-1. I have added a new configuration option to set whether entire messages are quarantined as the raw queue files (as they were in Version 3) or as readable head+body files.
I have also improved the install.sh script in the RPM distribution, and fixed all the other outstanding bugs that I know of.
22/10/2002 Released 4.01-7. If you weren't delivering disinfected messages, then the notifications to the sender and the local postmaster would not be sent.
22/10/2002 Another bug fix :-( This time it corrects a problem where messages would not be checked for spam if "Virus Scanning = no".
Also fixed "no warnings" problem I created in 4.01-5.
I've had better days...
21/10/2002 Fixed an important bug in 4.01-3 that could cause MailScanner to stop processing mail in certain circumstances. Also corrects spam handling anomalies. I strongly advise anyone using version 4 to upgrade to this release. There are no changes to the conf files at all, so the upgrade should be very simple.
20/10/2002 Fixed an important bug in the RedHat distribution of 4.01. If you are running this version, you must upgrade. It's a 1 line fix, so you can change /usr/sbin/MailScanner by editing it and changing the -I option in line 1 to -I/usr/lib/MailScanner
20/10/2002 Released new version 4.01-1. This is the first production release of the new Version 4. Much faster than Version 3, much more flexible configuration options, suitable for loads from 10 messages per day to 10 million (or more) messages per day. Loads of new features, far too many to mention them all here. Read the Change Log.
10/10/2002 Released version 3.24-1. This improves the reporting of the "Bugbear" virus by putting all the message reports into the text that replaces the entire message. I have also fixed a bug where infected messages with no body could have their first attachment signed with the inline warning.
Note: This also includes another security patch for the MIME-tools modules, to cope with badly-formed attachment headers.
5/10/2002 New alpha release of Version 4 is available.
This includes content filtering by being able to convert HTML in messages into plain text, which is very effective against pornographic spam.
This also includes the first releases of sets of RPMs for RedHat Linux 7 and 8. Note that the RPMs are alpha releases in their own right, so please only try them if you are confident managing RPMs.
It looks like you should add "Bugbear" to the list of silent viruses as it can fake the "From:" address. I have yet to discover if it fakes the envelope sender address as well.
4/10/2002 Released version 3.23-5. There is a new option "Allow Object Codebase Tags" which you can use to disable the Microsoft- specific checks that are not covered by the "Allow IFrame Tags" option.
27/9/2002 Released version 3.23-4. This version detects and protects against messages with external bodies stored on FTP sites and other locations. See the recent BugTraq posting about "message/external-body" messages. There are 2 parts to this: another short patch for MIME-tools and an updated copy of MailScanner to use the patch. I have given copious instructions before on how to install patches for MIME-tools.
If you are using the RPM distribution of MailScanner, just upgrade the RPM and all the patches and new code will be installed for you.
25/9/2002 Released version 3.23-3. The HTML <IFrame> tag test which catches a load of Microsoft-specific security vulnerabilities is now configurable. Just set Allow IFrame Tags = yes.
24/9/2002 Released version 3.23-2. Have fixed the bug which made the maillog swear like a trooper.
22/9/2002 Released version 4.00.0a3. I have fixed a bunch of bugs, including incorrect log reports when finding no viruses. Remember this is still early days yet.
22/9/2002 Released version 3.23-1 and 4.00.0a2.
I have added traps for all known Outlook, IE and Eudora security vulnerabilities, and MailScanner now catches all of the GFI email security tests. This makes MailScanner a complete e-mail security system, rather than just being a virus scanner. See http://www.gfi.com/emailsecuritytest for information about these tests.
Fixed a bug where the "domains.to.archive.conf" file would ignore complete e-mail addresses containing a '.' before a '@'.
Version 4 additionally fixes the obvious bug where the check_mailscanner script would not work unless you were in the installation directory when you ran it.
21/9/2002 I have added a "donations" page with a link to PayPal, should you want to make a donation for your copy/use of MailScanner.
20/9/2002 Version 4: The first alpha test release of version 4 is now available from the downloads page. Please do not touch it if you aren't totally happy with it. I have tested it on my own systems and it works okay for me, but more than that I can't say. Your results may vary. The value of your investments may go down as well as up :-)
12/9/2002 Security Release: I have released version 3.22-14. This addresses an exploit recently advertised on the Bugtraq mailing list, involving fragmented email messages which can be easily created with Microsoft Outlook Express.
If you use the tar distribution, you will have to apply the mime-tools-patch2.txt to the MIME-tools module, in addition to the mime-tools-patch.txt I created long ago. If you unpack the MIME-tools into the current directory, then the command "patch -p0 < mime-tools-patch2.txt" should apply the patch. If you have trouble applying the patch, please read the documentation for the patch command or else apply it by hand, it's a very simple patch.
If you use the RPM distribution, applying this patch to your system will all be done automatically.
10/9/2002 Released version 3.22-13. This just contains a few fixes:
Fixes the problem caused occasionally when logging names of file attachments whose names include '%' characters.
Improved Command AV parser.
Improved Sophos.install scripts included.
Simplified the wildcard whitelist checking code when looking for spam, to make it more reliable as previous version fails occasionally.
Fixed Exim setuid/setgid ordering bug.
16/8/2002 Sophos users: If you have ever directly run the install.sh script supplied with Sophos, you may have trouble upgrading Sophos to version 3.60. I have modified the Sophos.install script to handle this situation. There are Linux and Solaris/other Unix versions.
15/8/2002 Released version 3.22-12. One very minor improvement to the F-Prot parser (to handle messages possibly containing unknown viruses), and a new configuration option Still Deliver Quietly Deleted Viruses. This feature was added on request.
11/8/2002 Released version 3.22-11. Changes to handle 2 security vulnerabilities (one for Exim, one for Eudora), and 2 other minor changes.
1. Exim users only: there was an internal Perl issue with the handling of Subject: lines longer than 32766 characters.
2. Eudora users only: a vulnerability has been found in certain versions of Eudora, when used with certain versions of Windows 2000, where a buffer overflow problem would arise if the boundary separating MIME sections of a message is longer than 138 characters. A sample exploit has been published on the Bugtraq mailing list. My patch detects and neutralizes attempts to exploit this vulnerability in Eudora.
3. Fixed deletion of core files found in working directory.
4. Added logging to McAfee parser to improve virus-logging.
30/7/2002 Released version 3.22-10. Fixed a minor bug in the spam whitelisting code that would cause whitelisted domains to be sometimes marked as spam.
29/7/2002 Released version 3.22-9. New code in 3.22-8 to fork off MailScanner daemon at startup has been abandoned due to instability problems on a few versions of Solaris. I strongly recommend non-Linux users to upgrade to this version.
27/7/2002 Release version 3.22-8. Bug fixes: spam logging should now log the correct domain, sender warnings now correctly support "Hide Incoming Work Dir" option, code that forks off MailScanner daemon at startup improved to protect from zombie processes on BSD.
23/7/2002 Security alert: Due to a posting on NTBugtraq today, I would advise all MailScanner users to add a "deny" rule for \.mhtml$ to protect yourself against a newly discovered META-REFRESH attack against Eudora.
23/7/2002 Version 3.22-7 improves the F-Prot parser to cope with the new "mass-mailing worm" output it can produce. Many thanks to Alan Ford at Newnet for reporting this one.
Note: I strongly advise all F-Prot users to upgrade.
22/7/2002 Version 3.22-6 addresses a couple of complaints about the new function of the spam.whitelist.conf file matching both inbound and outbound addresses. The syntax of the file has been enhanced to allow for a "From:" or "To:" keyword on each line indicating whether the address should match the sender or recipient addresses of the message.
22/7/2002 I have released version 3.22-5.
A few new features this time:
Spam White List configuration option now gives a filename whose contents are checked against both the sender's address and the recipients' addresses.
Max Spam List Timeouts configuration value gives the threshold for the number of consecutive times a single "Spam List" or "Spam Domain" entry can timeout before it is removed from the list of places to be checked. It will be restored to the list at the next restart (every 4 hours by default).
Max SpamAssassin Timeouts configuration value works the same way as "Max Spam List Timeouts" except it applies to SpamAssassin instead.
Hide Incoming Work Dir configuration option allows you to hide the full directory pathname from the messages sent to users.
Sign Messages Already Processed configuration option allow you to only sign messages once, regardless of how many times it has been scanned by your site.
There are also a few improvements, such as automatic cleanup of core files, improvements to the RedHat init.d script to ease upgrading, improved logging of RBL timeouts, and another form of wildcard in all the files that take addresses and domains. You can now have wildcards like "spam@*" as well as "*.domain.com".
The RAV installation directory has been changed to /usr/local/rav8/bin which is where the RAV 8.x installation program puts it. The F-Prot autoupdate script now handles stray ^M characters properly, and incorporates the fix recently published by F-Prot.
The "Multple Headers = replace" option is now more robust against bugs in some versions of Perl.
28/6/2002 I have written FAQ 22 on the subject of why MailScanner does not yet support "daemonized" virus scanners as OpenVirusScanner and the daemonized version of F-Prot.
27/6/2002 I have produced a df2mbox script which will convert complete quarantined messages (such as all your stored spam) into "mbox format" files which you can read with pine or Eudora (to name two). See FAQ 21 for more information.
27/6/2002 Version 3.21 released.
This contains a couple of minor bugfixes, and you can now separate MailScanner's logging messages from your sendmail/Exim logs using the new "Log Facility" configuration option.
The "Notify Senders" configuration option has been extended to allow the value "local" where only senders listed in the "Local Domains" list will be notified, and not those outside those domains.
There is a new "High SpamAssassin Score" configuration value to set the minimum SpamAssassin score above which the "High Scoring Spam Action" setting applies.
There is a new "High Scoring Spam Action" configuration value to set the action applied to all messages whose SpamAssasssin score is greater than the "High SpamAssassin Score".
25/6/2002 A small bug has been found in the SpamAssassin report-handling code. This can cause the delivery of a very small percentage of spam email. The fix is 1 line, and involves simply editing sendmail.pl and adding the line
$SAreport =~ s/\s+$//g if $SAreport;
after the line that says
$SASaysSpam = 0 unless $SAreport; # Solve bug with empty SAreports
which is line 285 in the latest release.
23/6/2002 Released version 3.20-7.
This corrects a small problem with the mail queue ownership (if you don't run MailScanner as root).
Messages containing viruses listed in viruses.to.delete.conf will now be delivered (clean) to the recipient just as normal, but the sender will not be informed; this is a slight change to the previous operation of this option.
The RedHat RPM init.d script has been improved: it now supports a "status" command, and if you change the outgoing queue delivery interval this value can be kept across upgrades.
20/6/2002 Written a much better RedHat Linux /etc/rc.d/init.d/mailscanner script.
19/6/2002 RPM installation now has latest MailTools package, V1.46. Tar distribution is unchanged.
19/6/2002 I have fixed a problem where, rarely, a message will get a blank SpamAssassin report, which will cause email filters to consider it as spam. Released Version 3.20-5.
18/6/2002 I have written an autoupdate script for F-Prot. It aims to do exactly the same as the one supplied with F-Prot, except that it also does the proper file locking so that MailScanner cannot attempt to use F-Prot while the update is actually happening.
17/6/2002 Released Version 3.20-4. This corrects the problems some users have experienced getting false alarms from SpamAssassin.
15/6/2002 I've come up with a possible solution if you are getting false alarms from SpamAssassin, where a message gets marked as spam even though the "hits" < "required_hits". Try applying this patch and see if it solves the problem. Please let me know how you get on.
15/6/2002 Everything seems to work okay with SpamAssassin 2.30. Check the mailing list archives to see my experiences installing and testing it.
14/6/2002 Released Version 3.20. Many new features and improvements in this release. For fuller details read the ChangeLog (in the docs directory) and the mailscanner.conf documentation.
Some of the new features/improvements in this release are:
Moved McAfee support from "mcafee" directory to "uvscan" to make McAfee installation simpler.
Added support for Panda and RAV virus scanners, bringing total supported to 10
Many performance optimisations
Added configuration option to list viruses that should be quietly deleted without informing the sender or recipient. A good example is the "Klez" worm
Improved performance of SpamAssassin by pre-compiling all code
Added configuration option to enable SpamAssassin's "auto-whitelist" functionality
Added optional internal TNEF expansion using CPAN Perl Convert::TNEF module
Updated version of MIME-tools module shipped and included mime-tools-patch.txt from Bugtraq
Added support for RBL lists that work by domain name rather than by IP number
Note for Exim users only: Due to a re-write of the locking code, MailScanner currently supports Linux, BSD (any variant), Solaris, AIX and IRIX. If you are using a different OS such as HP/UX, please contact us so we can quickly add support for your system.
10/6/2002 MailScanner has got a good write-up on linuxsecurity.com. Here is the full article.
7/6/2002 Security patch for MIME-Tools
A member of the Bugtraq mailing list has found some potential security problems with the MIME-Tools module that MailScanner uses. They have released a patch which they claim resolves these problems. I have tested it on my systems and it does not appear to cause any problems. It is a patch for version 5.411 (latest stable release) of the MIME-Tools module, so if you do not have that version yet then you should download it from www.zeegee.com and unpack it, then apply the patch.
20/5/2002 Released Version 3.15-3. Fixed bug where non-spam messages from whitelisted hosts/networks, when SpamAssassin header was always included, would give an empty SpamCheck: header.
19/5/2002 Released Version 3.15-2. Couple of minor fixes.
19/5/2002 Released Version 3.15. No very major changes this time, but a few improvements that have been requested:
Added "Always Include SpamAssassin Header" option so you can have spam reports on non-spam messages
Added "default" rule to spam.actions.conf file. See the supplied file for an example, and the documentation
Implemented switch to control logging of allowed attachment filenames
Most systems will no longer need "syslogd -r" for logging to work
F-Prot parser handles non-working copies of viruses
RPM file now saves config files rather than overwriting them
17/5/2002 I have just added a FAQ that explains how to use MailScanner when your mail server runs Microsoft Windows or any other OS you care to mention, or any other mail system I don't support (e.g. Postfix, Qmail, Exchange, NTMail, etc).
14/5/2002 Released Version 3.14. Changes for this version are:
Implemented per-user and per-domain control of what to do with spam
Added "Subject:" line modification for viruses, same as for spam
SpamAssassin report now also includes names of successful tests
Infected "multipart/alternative" messages are converted to "multipart/mixed" so that virus warning can always be seen.
Files which pass the filename rules are now logged
Added section about "exim_tidydb" command to Exim docs
File "domains.to.scan.conf" can now be a copy of Exim domain map file
Added ".scr" to supplied list of banned filename extensions
Added another FAQ (12) about settings for high-volume mail servers
Fixed tainting bug in ClearOutQueue()
Made documentation stylesheet a local file
Fixed handling of "Return-Path:" header
Fixed case sensitivity bug in local domains file
Fixed bug in Sophos autoupdate to account for new "vdl" filename
11/5/2002 Next release due soon. I have implemented per-user and per-domain control of what to do with spam (deliver/store/delete), and added modification of the subject line in messages that had a virus in them.
I have fixed a few minor bugs such as handling infected multipart/alternative messages rather more neatly, and the Sophos autoupdate code (which broke when Sophos changed the VDL filename).
25/3/2002 Released version 3.13-1.
Fixed bug where carriage return characters embedded in subject lines could stop MailScanner being able to extract files from the message.
Fixed bug in Sophos NSV autoupdate code.
7/3/2002 Released version 3.12-5.
Fixed bug where McAfee auto-updating script used the wrong lockfile.
5/3/2002 Released version 3.12-4.
Fixed bug causing "Mail Archive" feature to not work. Sorry!
5/3/2002 Released version 3.12-3. Changes from previous version are:
Domains To Scan now supports wildcards, e.g. *.julianfield.net,
Spam White List now supports wildcards, e.g. *.julianfield.net,
Greatly improved F-Prot parser (this should be the last major change to the parser),
Support for SpamAssassin 2.1 and upwards,
Stopped McAfee wrapper producing "kernel: cdrom open failed" errors,
New feature: Mail Archive to save all incoming mail to a directory,
Support for Inoculan 4.x virus scanner.
Fixed the bug in changing the subject line when spam-tagging with Exim (hopefully!)
Note: I would strongly advise all F-Prot users to upgrade to this version.
2/3/2002 I have added support for SpamAssassin version 2.1, but have had to remove support for earlier versions. It will complain at startup if your SpamAssassin is too old.
I have also added Inoculan 4.x support, provided by gabor.funk@hunetkft.hu.
25/2/2002 I have improved the F-Prot parser some more, it should now cope with all the output that F-Prot can generate.
22/2/2002 Modified feature: I have changed the "Spam White List" to support wildcards in the same say as the "Domains To Scan" list described below.
21/2/2002 Modified feature: I have changed the "Domains To Scan" list when scanning by domain. It will now match any address whose domain ends in one of the names listed in the domains.to.scan.conf file. So putting *.julianfield.net in the domains.to.scan.conf file will cause all mail to/from anything.julianfield.net to be scanned, as well as all mail to/from julianfield.net.
This code will be included in the next release, but please ask if you want it before then (release date unknown at the moment).
15/2/2002 Security Alert: A bug in Microsoft Outlook Express has been brought to my attention. By exploiting this bug, Outlook Express can be made to see a file attachment that is embedded in the message headers, and is currently not checked by MailScanner. As far as I am currently aware, no virus is yet exploiting this security hole. However, it is a simple 1-line fix to solve the problem, and I have just released version 3.11-1 to solve it.
12/2/2002 Version 3.10-4 released.
F-Prot parser updated to recognise output about "destructive programs".
12/2/2002 Version 3.10 released.
Virus scanning per domain now implemented. It's an "all or nothing" switch per domain, I'm afraid. Keeps it simple. One or two minor bugfixes and improvements to some of the support scripts, please don't ask for too many details (I can't quite remember :-)
28/1/2002 Emergency: The MyParty virus slips through versions of MailScanner before 3.04-1. You must update to 3.04-1 to be able to catch this virus. If you want to fix it without upgrading, find the function DefinitelyClean in sendmail.pl and insert "return 0;" at the start of the function.
21/1/2002 There are now some graphs showing the number of downloads by month and by version. Yell at me if they get out of date...
21/1/2002 Due to a very generous gift from Paul Welsh (a MailScanner user), I now have the addresses www.mailscanner.biz, www.mailscanner.org.uk and www.mailscanner.co.uk all pointing to this site (in addition to www.mailscanner.info which I had already). Many thanks to Paul for this!
17/1/2002 Version 3.03-1 released. New features/changes/fixes include:
Several virus scanners can now be used together.
X-MailScanner-SpamCheck: SpamAssassin headers now include the number of hits.
Lock File Dir configuration option.
Improved F-Prot output parser to fix handling of joke programs, trojan programs and encrypted archives. All F-Prot users should upgrade.
F-Prot output parser no longer stops when it gets output it doesn't recognise.
Minor Inoculate and CommandAV parser fixes.
Double-bounces of MailScanner messages now go to local postmaster.
Fixed wrapping of virus scanner reports.
Fixed bug where virus scanner would still be called with "Virus Scanning = no".
Fixed bug in subject line spam tagging for Exim. All Exim users should upgrade.
Improvement to Sophos.install, checks for install.sh script before calling it.
8/1/2002 Bug fix to improve stability and to stop Perl core dumping.
Bug fix causing SpamAssassin to mark everything as spam.
Bug fix in F-Prot parsing code to support trojans and backdoor programs properly. All F-Prot users should upgrade.
Bug fix in Inoculate parsing code. All InoculateIT users should upgrade.
Improvement to logging when viruses originate from inside your own network.
Changed localdomains.txt to localdomains.conf.
Release of version 3.02-1.
All users having any problems should upgrade.
5/1/2002 Bug fix in InoculateIT parsing code and release of 3.01-3.
4/1/2002 I have fixed a problem scanning inside Zip files with F-Prot and released version 3.01-1.
4/1/2002 I have written some notes about the Minimum Code Status configuration option, as it seems to be causing some confusion (especially among users who haven't read the documentation :-)
4/1/2002 Improved the code that links messages between the queues when moving them. Minor change to sendmail.pl.
3/1/2002 Fixed a problem in the tar distribution where the mailscanner script was wrong. Nothing has changed in the RPM distribution.
3/1/2002 The previous version (2.60-2) was downloaded 3,441 times. As I know that quite a lot of you never upgraded to that version, I would estimate the number of MailScanner users out there to be at least 4,000 !!!
3/1/2002 Version 3.00 released. Loads of new features in this version:
  • Support for new virus scanning engines (as well as Sophos and McAfee):
    • F-Prot -- free for Linux at the time of writing this page
    • F-Secure
    • Kaspersky
    • CommandAV
    • InoculateIT
  • Add a signature to clean messages showing they were scanned by MailScanner, in either/both text and HTML
  • Include the full message headers in virus reports to the local Postmaster
  • Support for the SpamAssassin project to greatly improve the success of spam identification. See http://spamassassin.taint.org/ for installation instructions.
  • Stop messages that ever had a virus in them leaving your site, even after they have been cleaned up and had viruses removed. Saves washing your dirty linen in public!
  • Set the attachment warning filename so it doesn't have to be VirusWarning.txt any more
  • Support for Sophos' (undocumented) built-in TNEF decoder to improve the decoding of Microsoft Outlook Rich Text Format attachments.
  • Latest version of the public domain TNEF decoder included.
  • Revised filename.rules.conf file to set the order of the rules correctly
13/12/2001 Quite a few people have asked about monitoring MailScanner using MRTG so they can draw some graphs showing mail throughput, number of viruses caught, and so on. I have written a page about MRTG support which includes the scripts and configuration files I use to do it.
13/12/2001 The new version is close to completion. For a sneak preview of some of the new features, look here for any mention of "3.00". There are a few new keywords and a few updated ones.
7/12/2001 Things have been a bit quiet on the MailScanner front recently. There have now been over 2,300 downloads of version 2.60-2. Work on the next version is in progress and I expect to release something around Christmas time.
7/12/2001 Got onto the Cover Disc of the December issue of Linux Format magazine. They don't say much about it, but they did include it which is nice.
7/11/2001 Won "Best Of Linux" award on DaveCentral.com. He also wrote a very nice review.
29/10/2001 Released version 2.60.
Description is as below, there are now more text files in the etc directory to customise. I have also tweaked the timeout code again to make it more reliable.
24/10/2001 The next version, 2.60, is on the way. I have added more text files to the etc directory so that users get different responses (and replacement attachments) depending on whether it found a virus or whether it failed one of the filename traps. This should make things easier to understand for our poor hard-done-by users :-)
23/10/2001 Released version 2.54-1.
This is a bug-fix release, corrects a problem with modifying the subject line of spam when using Exim. This change does not affect sendmail users at all.
The Linux version now uses wget instead of lynx due to problems seen with some versions of lynx when running from crond.
Also, to reduce the number of problems related to MIME-tools, minimum version numbers of some modules are now checked.
18/10/2001 Released version 2.53-1.
This includes improved handling of unparsable messages, and should also resolve any outstanding problems with timeouts that were present in version 2.52. It also logs its version number when it starts up.
16/10/2001 I have just found a bug that under rare circumstances (a MIME message badly formed in a very particular way, only originating from Apple Macs) MailScanner would fail and stop. This is the first time I have seen this happen in over a year of use. However, I have improved the handling of badly formed messages enough so that nothing stops. The fix will be included in 2.53 due out at the end of this week.
12/10/2001 Update on 2.52: The code fix I propose is working well so far, if you want a copy of the 2 new files then mail me, otherwise I'll release it towards the end of next week if it's proved to solve the problem.
2.52 is having one or two problems, I suggest you use 2.51 until I manage to prove that my fixes work. More news as it happens...
9/10/2001 2.52-2 contains updated text in the Linux RPM distribution. The tar distribution is exactly the same as 2.52-1.
9/10/2001 2.52-1 released. Added configuration option "Deliver in Background" which makes it run the sendmail processes in the background instead of waiting for them to complete.
Also the Linux RPM uses wget rather than lynx to fetch Sophos updates (in /usr/local/Sophos/bin/autoupdate) as it is better for cron jobs than Lynx.
I have also removed the sample sendmail.cf file from the distribution altogether as it continues to cause confusion.
5/10/2001 Any remaining problems with timeouts apparently not working have been solved. This will be in release 2.52-1 which you can have on request if you urgently need it, else I'll release it around the end of next week. I have also added a configuration option to allow the "sendmail" processes to be all run in the background, instead of waiting for them to complete.
It will also use wget on Linux instead of lynx as it is more suited to running from a cron job.
4/10/2001 2.51-2 released. Slight bug in sweep.pl stopped the removal of macros viruses from attachments working. *No* viruses would get through as a result of this bug, just one of the nice features of this package wouldn't work.
4/10/2001 2.51-1 released. Added configuration option "Deliver Unparsable TNEF" to allow compatibility with earlier behaviour where Microsoft Outlook Rich Text Format attachments that could not be decoded were still delivered. The default is "no".
2/10/2001 2.50-2 released. Corrected one typo in sweep.pl (that's all).
1/10/2001 Version 2.50 released. New features are all mentioned below, and new mailscanner.conf switches are documented.
27/9/2001 Version 2.50 will also feature a "spam white list" consisting of a file holding email addresses and email domains from which you will accept mail without ever marking it as spam.
26/9/2001 MailScanner is now right near the top of the ratings chart at FreshMeat. If some more people could vote, we might make it to number 1 again!
Version 2.50 is near completion. This will feature timeouts to prevent Denial Of Service (DoS) attacks by people sending you things like the Zip of Death file (a small zip file which expands to thousands of terabytes). It will also feature the new version of the TNEF decoder, with an extra switch added to avoid other DoS attacks. And a couple of minor features requested by users (turn off virus scanning, turn off delivery of cleaned messages to users).
10/9/2001 Version 2.42 released.
This version allows you to modify the Subject: line of messages identified as being likely spam. There are 2 new configuration variables controlling this, "Spam Modify Subject" and "Spam Subject Text" which are both documented.
3/9/2001 We have discovered a problem in the Exim installation notes. Taking the steps given to stop the incoming Exim from ever accidentally delivering mail, will also cause it to operate as an open mail relay. This is okay if it is one of your internal mail servers, but obviously is very bad if it is one of your MX hosts. For now, please don't follow these 3 steps until we find a better solution.
31/8/2001 Version 2.41-2 released.
There is a slight bug in the Sophos autoupdate script, which in some situations may cause the wrong IDE files to be fetched from Sophos, if the version of Sophos has been updated since it was originally installed. This is due to Sophos' installation program leaving an old version of a file lying in the sophos/lib directory.
Either install the entire latest release or just fetch the appropriate replacement Linux or Solaris/Unix script.
30/8/2001 Version 2.41 released.
New feature is more intelligent handling of MailScanner status headers when a message has passed through multiple MailScanners. It is now configurable, but the default behaviour is to append new information to the existing X-... header, rather than add a new header.
29/8/2001 Important: I have discovered that some of you may have corrupt copies of the tnef binary, which is in the MailScanner bin directory and is used to unpack Microsoft Outlook Rich Text attachments. To test it, cd into the bin directory and run the command ./tnef --help which should produce a help message. If it doesn't produce a help message, please download a replacement Linux or Solaris binary and copy it into this directory, ensuring that you have permission to execute it (type chmod +x tnef* in the bin directory).
This issue will be fixed in the 2.41 release due in the next few days.
29/8/2001 Installation guide now available in Portugese.
15/8/2001 Version 2.40 released.
Save a copy of your /etc/sendmail.cf, and /usr/local/MailScanner/etc or /opt/mailscanner/etc files before installing the new version as the upgrade may well overwrite them (particularly when using the Linux RPM).
There are several new configuration file options, read the documentation carefully and merge your mailscanner.conf customisations into the new supplied version of this file. Make sure that any long lines (eg. the "Inline HTML Warning") don't word-wrap in your text editor!
There is also 1 new addition to my suggested filename.rules.conf file (to trap .reg files).
Managed to propogate a bug in /etc/rc.d/init.d/mailscanner from the previous version of the Linux RPM, hence there's now a 2.40-2 RPM.
15/8/2001 Discovered the official version of how the RBL+ works, thanks to Michael Forrest. The line of code in sendmail.pl mentioned below for using the RBL+ should read
   if ($RBLEntry =~ /^127\.[01]\.0\.[1234567]$/);
12/8/2001 Created a mailing list, subscription instructions are shown above in the "Talk To Me" section.
10/8/2001 Version 2.40 is now in testing, hopefully will release next week.
Changes include:
  • Merged Sendmail, Exim, Sophos and McAfee versions into the same code
  • Can now insert a warning message directly into the body of a disinfected message, which can be used to warn the user that they should read the VirusWarning.txt attachments. Plain text and HTML versions of this warning are provided in the configuration file
  • Delivers messages in batches with sendmail and exim for speed
  • Improved Exim file locking
  • Support for MAPS RBL+ incorporated
  • Fixed McAfee dying-after-disinfecting bug
  • Linux now successfully writes to syslog (see the FAQ)
  • Lots of internal re-organisation to make the code easier to maintain
9/8/2001 Added an Installation FAQ. All suggestions for questions (and answers) are welcome.
6/8/2001 Support for the RBL+ spam list. Due to not having a subscription before, I never discovered that it produces different format results from the other MAPS lists, so you need to make one small change to the source:
Look in sendmail.pl for the string 235 and you'll only find 1 occurrence. Change that line to read
   if ($RBLEntry =~ /^127\.[01]\.0\.[12345]$/);
Then add the line
   Spam List = MAPS-RBL+, rbl-plus.mail-abuse.ja.net.
to mailscanner.conf and you're away.
6/8/2001 Version 2.40 is almost ready. Significant changes are:
1. Support for RBL+
2. Merged Exim and Sendmail versions into one
3. Warning message can now be added to the top of the message body, making it easier for users to understand what the VirusWarning.txt attachments mean. Both HTML and plain text supported.
If you want other features, please request them now.
29/7/2001 Added a list of users of MailScanner.
Discovered minor bug in Linux distribution, please uncomment the call to mailscanner in /etc/rc.d/init.d/mailscanner.
10/7/2001 Sample mailscanner.conf file updated to include use of ORBL and ORDB replacements for the now-defunct ORBS open mail relay database.
14/6/2001 Exim version of 2.30 released.
12/6/2001 McAfee compatibility added to Release 2.30.
8/6/2001 Release 2.30-2 produced. This includes minor corrections to file permissions, and includes the missing sophoswrapper script.
7/6/2001 Release 2.30 produced.
This release includes automatic disinfection of macro viruses and any other viruses that can be disinfected (Sophos only, not McAfee yet).
31/5/2001 Exim installation notes finally put on-line.
Solaris release check_mailscanner script corrected to use SysV ps command. Release 2.20-2 for Solaris/non-Linux systems produced.
29/5/2001 Linux distribution of Version 2.20 released for sendmail and Sophos.
McAfee versions of 2.20 released so you don't have to use Sophos. I personally still strongly recommend Sophos over McAfee.
25/5/2001 Version 2.20 released for sendmail and Sophos. This release decodes Microsoft's MS/TNEF format and virus-checks the files contained within. This release also includes a greatly improved Sophos autoupdate script and a script to automate installation of Sophos.
24/5/2001 Someone has reminded me that the McAfee code has disappeared. Expect it back soon!
24/5/2001 I have got proper MS/TNEF decoding working, using the tool at http://world.std.com/~damned/software.html. Expect to see a new release (probably version 2.2) very soon. Exim version of it will follow a few days later.
24/4/2001 There are some new plans for the next version.
23/4/2001 New release for Exim, fixed some "header munging" bugs
19/4/2001 Version 2.14 released for Exim mail transport agent, so you don't have to use sendmail if you don't like it or find it rather too scary ;-) Documentation will follow, mostly just have a good read through the supplied mailscanner.conf file.
18/4/2001 In some installations of sendmail 8.11.3, MailScanner would fail to detect viruses properly. This has been found and fixed. Version 2.14 released as both a tar file and as a Linux RPM.
9/4/2001 I have updated the RPM distribution and fixed the file location errors. Should work straight out of the box much more easily now. Have done more testing on sendmail 8.11.3 from sendmail.org and it detects viruses fine on that version.
30/3/2001 I have updated the filename.rules.conf file to include some more known dangerous Microsoft file extensions. This now includes all the extensions which are known to be hidden even when you have Windows Explorer set to show all file extensions.
23/3/2001 I have prepared an RPM distribution of MailScanner for Linux. This should make it far easier to install. Just download it, install the RPM, correct the "DH" and "DM" lines in /etc/sendmail.cf and you are up and away. If you are interested, the RPM spec file used to build it is here as well.

MailScanner would like to thank the following for their support:

Click here

[Powered by Google]   Translate this page to 
Copyright 2006 © Julian Field/Mailscanner