Incoming e-mail virus scan with Evolution

[dcstar]

Ok, I am posting this here because my previous thread is in the old locked Desktop archive.

You can have Evolution scan all of your incoming e-mails for viruses and notify you of any detected.

First you have to install the following packages:

clamav clamav-freshclam

This should install the basic Clamav system that updates itself automatically (there are other clam packages you can install for extra functionality).

Then create a script in a convenient place (like your /home directory), I called mine clam-filter and it contains the following:

#!/bin/bash
# Fred Blaise <chapeaurouge AT madpenguin DOT org>
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston,
# MA 02111-1307 USA

FILE=/tmp/$$_outclam.tmp
# clamscan for non-daemon scanning - clamdscan when the daemon is installed
clamscan --no-summary --detect-pua=yes --detect-structured=yes - 1>$FILE

if [ $? -eq 1 ]; then
STRING=$(grep "FOUND" $FILE |cut -d: -f2)
zenity --warning --title="Evolution: Malware detected" --text="$STRING" &
logger -t clamav/Evolution <$FILE
exit 1
fi

exit 0

After you create it, make it executable:

chmod 777 clam-filter

Go into Evolution-Edit-Message Filters and create a new Incoming Filter called Virus scan with location of the clam-filter script in the Pipe to Program location and an Evolution folder to dump any e-mails with a virus into (I made one called "Virus Dump) - see attached screenshot.

Make sure that the filter is at the top of the list and all of you incoming e-mails should be checked by Clamav (so you know when you receive a Windows virus or other malware).

You can test the functionality by sending yourself an e-mail containing one of the Eicar test files:

http://www.eicar.org/anti_virus_test_file.htm

[dcstar]

You can have Evolution scan all of your incoming e-mails for viruses and notify you of any detected.

Script updated to do more scanning and also to log an entry to the Syslog.

[lz1dsb]

Quite interesting. I think I'll give it a try. I didn't know that there're antivirus packages for Linux though... I thought that all viruses are written only for Windows...

Cheers,
Boyan

[dcstar]

Quite interesting. I think I'll give it a try. I didn't know that there're antivirus packages for Linux though... I thought that all viruses are written only for Windows...

Don't you want to see all the Windows malware that gets sent to you?

It also detects bogus e-mail links in messages that are there to deceive you, these things are platform independent and IMHO most people would rather be informed of them than risk clicking the link.

[lz1dsb]

You're right. I'll really try it out, that's really the point. I didn't mean to be sarcastic in any way though...

Cheers,
Boyan

[dcstar]

You're right. I'll really try it out, that's really the point. I didn't mean to be sarcastic in any way though...

Cheers,
Boyan

Didn't take it that way, some people like seeing Windows malware that has no effect on their systems......

[ImmaNoob]

Hi,

I followed everything you wrote and now that I have all setup, how can I test everything?

Thx for your reply....oh btw.... YOU ROCK Dude

OK i just missed the eicar part. sorry!!!

[fimasava]

Well... All done, but all my incoming emails now are moved to the tray "Virus-Dump"

???

[Manyette]

Hi DCSTAR,
Many thanks. That is just what I've been looking for. Well done indeed. It works as advertised and thanks for adding the info on test files. I don't worry about viruses, but I try to take pity on my friends who are locked into another OS. Again, many thanks.

[ussndmac]

Followed all the setup steps, attempted to test it...

My provider won't send the email cuz it detects the virus sig in the test file.



Any way around that?