ClamMailFilter is a small GPL project to be used in conjuction with procmail and clamscan which adds a header to infected mails before passing them back to the procmail pipe. Incase we get delivered more than one mail in the loop we cheat and save the incoming mail in to a temporary mbox file, the file is then opened using the perl module Mail::Box and the seperate parts of multipart messages are saved in to a temporary directory, which is then scanned by clamscan.
The headers that are injected in to infected e-mails are as follows:
- X-Virus-Found: Yes
- X-Virus-Details: <List of Viruses that this mail is infected with>
If something went wrong whilst running clamscan, the following headers are injected:
- X-Possible-Virus: YES
- X-Virus-Details: An error occured when running the virus scanner, possibly a corrupt archive
The current version can be downloaded from here, this is currently version 0.93.