Remove infected virus attachment and substitute another message body
Posted on 2004-03-28
I have a good working setup of ClamAV that catches email viruses very well (several a day lately!). Right now my system sends all infected mail to /dev/null/. Everything works great that way.
What I would like to do is to send the intended RECIPIENT of the message a note that a message arrived infected and was deleted before it got to his inbox. (Note: NOT the sender!)
No problem for me to change the SUBJECT to "VIRUS FOUND - CONTENT DELETED". That part is easy.
What I want to do is to REPLACE both the body and attachment with a few lines explaining what happened and then send the mail on to the recipient's mailbox with the headers as they were (WITHOUT the body and file attached of course.)
I think this can be done within the recipe that identifies that a viruse was found BEFORE (or in place of) sending it on to the /dev/null... here is that part of my .procmailrc file:
* ^X-Virus-Status: Yes # a virus was present - we need to send the recipient
# a note with the original headers that a virus was
# found and removed!
/dev/null/ # FOR NOW we will just remove the whole thing