AMaViS - A Mail Virus Scanner Christian Bricart, [1]shiva@aachalon.de Rainer Link, [2]link@suse.de version 0.2.1, $Date: 2001/01/18 19:44:20 $ _________________________________________________________________ This document describes version 0.2.1 of AMaViS - A Mail Virus Scanner for Linux and other UN*X based platforms ( tested to run on Solaris, *BSD, AIX, HP-UX, too ) _________________________________________________________________ [3]1. Introduction [4]2. System Requirements [5]2.1 Virus Scanners [6]2.1.1 Network Associates Virus Scan [7]2.1.2 DrSolomon (obsolete) [8]2.1.3 H+BEDV AntiVir/X [9]2.1.4 Sophos Sweep [10]2.1.5 Kaspersky Lab AntiViral Toolkit Pro (AVP) [11]2.1.6 CyberSoft VFind [12]2.1.7 Trend Micro FileScanner [13]2.1.8 CAI InoculateIT [14]2.1.9 F-Secure Inc. (former DataFellows) F-Secure AV [15]2.2 Mail Transport Agents [16]2.2.1 Sendmail [17]2.2.2 QMail [18]2.2.3 Postfix [19]2.2.4 Exim [20]2.3 MIME Handlers [21]2.3.1 metamail [22]2.3.2 reformime [23]2.4 Decompressors and Decoders [24]2.4.1 uudecode [25]2.4.2. compress [26]2.4.3 gunzip [27]2.4.4 unzip [28]2.4.5 unarj [29]2.4.6 unrar [30]2.4.7 xbin [31]2.4.8 LHArc [32]2.4.8 bunzip2 [33]2.4.9 zoo [34]2.4.10 arc [35]2.4.11 freeze [36]2.4.12 tnef [37]2.5 File Type Recognition [38]2.5.1 file [39]3. Installation Instructions [40]3.1 Installing the Software [41]3.2 Modifying /etc/sendmail.cf [42]3.2.1 Modifying /etc/sendmail.cf manually [43]3.2.2 Modifying sendmail.cf via M4 macros [44]3.3 Testing Installation [45]4. Download [46]5. Future Outlook [47]6. Known Bugs [48]7. Disclaimer [49]8. Copyright [50]9. Credits [51]10. AMaViS in the press [52]11. History and Changes _________________________________________________________________ 1. Introduction Most people will say: "A virus scanner? For UN*X? Why? Viruses do not work in a UNIX environment." On the first glance they are right (even if there are at least two viruses which run under Linux - well, actually they are Trojan Horses) On the second view though, imagine a heterogene network environment with both UN*X and DOS / Windows / Macintosh workstations. Now think of an UN*X server that serves Windows and/or Macintosh workstations via a POP3 service. Would it not be nice to ensure attachments coming via email are scanned for viruses before they reach a system they are able to infect? Well - that is what this package is for. It resides on the server that handles your incoming mails. When a mail arrives, instead of being delivered via procmail directly, is parsed through a script that extracts all attachments from the mail, unpacks (if needed) and scannes them using a professional virus scanner program. Please note: This document mainly describes the function and implementation in a [53]Linux environment, but it should be portable to any UN*X available within the limitations outlined in this document ( currently only Linux tested by the authors). Successful installation has also be reported running on SUN Solaris, *BSD, AIX and HP-UX (some with minor modification to the package). Links to software packages point mainly point to source code which should compile under different UN*X systems. _________________________________________________________________ 2. System Requirements 2.1 Virus Scanners Note: For additional information please read README.scanners, too. 2.1.1 Network Associates Virus Scan Version 3.x Engine [54]Network Associates''s Virus Scan for [55]AIX, [56]HP-UX, [57]Linux, [58]NCR and [59]Solaris is no longer available from Network Associates. However, you may download the engine using the links above. An exerpt from NAI's "README" dated 12-15-99 04:22AM: [..] Release Notes for Network Associates 3212 .DAT Files Copyright (c) 1992-1999 Networks Associates Technology, Inc. All Rights Reserved. //////////////////////////////////////////////////// / THIS IS THE FINAL .DAT FILE RELEASE FOR THE V3.X / / PRODUCT SERIES. NETWORK ASSOCIATES RECOMMENDS / / THAT YOU UPGRADE TO CURRENT VERSIONS OF YOUR / / ANTI-VIRUS SOFTWARE. / //////////////////////////////////////////////////// [..] This latest (and last) DAT file is available [60]here Version 4.x Engine Cite: "A new Network Associates scanning engine has been created and backed by the combined efforts of the McAfee Labs and Dr Solomon anti-virus research teams to deliver the outstanding virus detection and cleaning rates." You may try to fetch the current version from a mirror for [61]HPUX, [62]Linux, [63]SCO and [64]Solaris. However, they may not have the lastest Version available. Direct download from Network Associates is available from the [65]NAI/McAfee Website. [66]Current DAT files have to be version 4.x and are the same for DOS/Windows. You may also use the [67]daily updated DAT files Note: This evaluation version is to be used free of charge for a limited time of 30 days. Then it has to be registered. 2.1.2. DrSolomon DrSolomon's Anti-Virus Toolkit for SCO-UNIX (running with the iBCS kernel module) Note: DrSolomon has become part of [68]Network Associates (NAI) and their product merged with [69]NAI/McAfee's VirusScan v4 2.1.3 H+BEDV AntiVir/X [70]AntiVir/X (German + English) AntiVir/X may be used free of charge in a non commercial environment. Please send a short e-mail with name, address and point out that you want to use AntiVir/X exclusive on your personal system. You then will receive a license for it. Support is avalialable via [71]linux_support@antivir.de 2.1.4 Sophos Sweep [72]Sophos [73]Anti-Virus for Unix is virus detection and disinfection software which can be installed on Unix file servers and workstations. Binaries for various Unices are available [74]here. 2.1.5 Kaspersky Lab AntiViral Toolkit Pro (AVP) [75]Kaspersky Lab [76]AntiViral Toolkit Pro (AVP) for Linux is available [77]here. 2.1.6 CyberSoft VFind [78]CyberSoft VFind is available [79]here 2.1.7 Trend Micro FileScanner [80]Trend Micro FileScanner is available [81]here. It's free for personal use. 2.1.8 CAI InoculateIT See CAI's [82]product page and get it [83]here. 2.1.9 F-Secure Inc. (former DataFellows) F-Secure AV Download it [84]here 2.2 Mail Transport Agents 2.2.1 Sendmail Sendmail is available at: [85]http://www.sendmail.org/ FIXME: For further information that may not be covered by this document please read the provided file README.sendmail 2.2.2 qmail qmail is available at: [86]http://www.qmail.org/ FIXME: For now please read the provided file README.qmail 2.2.3 Postfix Postfix is available at: [87]http://www.postfix.org/ FIXME: For now please read the provided file README.postfix 2.2.4 Exim Exim is available at: [88]http://www.exim.org/ FIXME: For now please read the provided file README.exim 2.3 MIME Handlers 2.3.1 metamail most recent version of metamail is available at: [89]ftp://ftp.funet.fi/pub/Linux/PEOPLE/Linus/net-source/mail/tools/. We do not recommend to use it anymore, as it seems not to be maintained and metamail can not handle MIME multipart/alternative messages. Please use reformime out of the maildrop package instead (see below). See also: README.metamail 2.3.2 reformime reformime is part of the [90]http://www.flounder.net/~mrsam/maildrop/maildrop package. Please have a look at README.reformime, too. 2.4 Decompressors 2.4.1 uudecode Note: GNU uuencode/uudecode 1.0 distribution has been merged into GNU shar utilities 4.2 distribution. Look for sharutils-*.*.tar.gz available at: [91]ftp://ftp.gnu.org/gnu/sharutils/ 2.4.2 compress From the compress (4.1) manpage: Compress reduces the size of the named files using adaptive Lempel-Ziv coding. Whenever possible, each file is replaced by one with the extension .Z, while keeping the same ownership modes, access and modification times. Note: (un)compress is not needed as [92]gunzip is also able to uncompress .Z files. Source code for compress is available at: [93]ftp://sunsite.unc.edu/pub/Linux/utils/compress/compress.tar.Z 2.4.3 gunzip From the gzip-1.2.4L.lsm file: gzip (GNU zip) is a compression utility designed to be a replacement for compress. Its main advantages over compress are much better compression and freedom from patented algorithms. Source code for gunzip is available at: [94]ftp://sunsite.unc.edu/pub/Linux/utils/compress/gzip-1.2.4L.tar.gz (also available as special [95]Pentium optimized binary version) 2.4.4 unzip From the unzip-5.31.lsm file: UnZip 5.31 is a free unarchiver compatible with PKZIP archives (zipfiles) but not a clone of PKUNZIP. This version improves performance somewhat and adds a new "timestamp" function for very fast dating of multiple archives, but most of its new features have to do with better cross-platform support and/or new ports. Multi-part archive support is *not* yet supported (sorry!). Work on that is already underway, however. Source code is available at: [96]ftp://sunsite.unc.edu/pub/Linux/utils/compress/ A tool named "zipsecure" comes with AMaViS. This program reads a zip file from stdin, removes any pathes of a contained file and changes the name of the file to a new file name. The new name starts with a "z" followed by the process ID and a sequence number. If any extension in the original name was present, it is also appended to the new name. The provided tool "securetar does similar to tar-files. 2.4.5 unarj From the unarj241a.lsm file: Standard unarj un-archiver, provided with the capability of creating directory hierarchies. Source code is available at: [97]ftp://sunsite.unc.edu/pub/Linux/utils/compress/ 2.4.6 unrar From the unrar-2.04.1.lsm file: The unRAR utility is a freeware program, distributed with source code and developed for extracting, testing and viewing the contents of archives created with the RAR archiver version 1.50 and above. Source code is available at: [98]ftp://sunsite.unc.edu/pub/Linux/utils/compress/ 2.4.7 xbin xbin is available as: [99]ftp://sunsite.unc.edu/pub/packages/TeX/tools/xbin/xbinunix.c 2.4.8 LHArc latest seems to be [100]version 1.14g but there is a version 1.15 at [101]http://shibuya.cool.ne.jp/lha/. 2.4.9 bunzip2 Have a look at the bzip2 homepage at: [102]http://sources.redhat.com/bzip2/ 2.4.9 zoo primary site: [103]ftp://metalab.unc.edu/pub/Linux/utils/compress/ 2.4.10 arc original site: [104]ftp://ftp.uu.net/pub/archiving/ primary site: [105]ftp://metalab.unc.edu/pub/Linux/utils/compress/ 2.4.11 freeze [106]http://metalab.unc.edu/pub/Linux/utils/compress/ 2.4.12 tnef A tool for decoding TNEF files is available at [107]http://world.std.com/~damned/software.html 2.5 File Type Recognition 2.5.1 file The "file" command is available at [108]ftp://ftp.astron.com/pub/file/ (primary site) or its mirrors [109]ftp://ftp.gw.com/pub/unix/file/ and [110]ftp://ftp.funet.fi/pub/unix/tools/file/. _________________________________________________________________ 3. Installation Instructions 3.1 Installing the Software Installation and operation is described here only for sendmail as SMTP-server. (See also the [111]Future Outlook section of this document) QMail users please read README.qmail, Postfix users please read README.postfix and Exim users please read README.exim. * [112]Get the package, * untar contents into a temporary directory, * read the instructions * be sure all required programs have been installed * run ./configure * run make * run make install * [113]modify your /etc/sendmail.cf * send a SIGHUP to your SMTP server ("killall -HUP sendmail") * [114]test your installation 3.2 Modifying /etc/sendmail.cf 3.2.1 Modifying /etc/sendmail.cf manually In your sendmail configuration file (usually /etc/sendmail.cf) the local mail delivery agent needs to be changed (typically this is one of procmail, deliver or mail) Find the line that begins with Mlocal and change the call for the program which resides after the "P=" directive. This has also to be changed after the "A=" directive: For example: Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=procmail -Y -a $h -d $u changes to: #Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, # T=DNS/RFC822/X-Unix, # A=procmail -Y -a $h -d $u Mlocal, P=/usr/sbin/scanmails, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=scanmails -Y -a $h -d $u Please have a look at the FAQ or BUGS if this leads to a malfunction. Note: If you prefer the m4 technique to configure sendmail, please read below. 3.2.2 Modifying sendmail.cf via M4 macros Add the following to you .mc file, i.e. linux.mc, just before the MAILER definitions: dnl change Mlocal to use AMaViS define(`LOCAL_MAILER_PATH', `/usr/sbin/scanmails')dnl define(`LOCAL_MAILER_ARGS', `scanmails -Y -a $h -d $u')dnl Note: On some systems, i.e. SuSE Linux, procmail is not suid for security reasons (see BUGS). So, if you're using sendmail 8.10.x or above, you may add dnl for security reasons on some systems procmail is not suid. dnl so we have to add the "o" flag and remove the "S"-flag dnl see BUGS for details on this issue MODIFY_MAILER_FLAGS(`LOCAL', `+o')dnl MODIFY_MAILER_FLAGS(`LOCAL', `-S')dnl 3.3 Test Installation So, how do you test if your installation has been successful? Don't ask me to send a wild virus ;-). Instead, create a file called eicar.com with the following contents: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* (The file should end up being 69 bytes long). As an alternative, feel free to download the file at: [115]http://www.eicar.org/download/eicar.com This should be recognized as a test pattern. It is NOT a virus, just a test pattern that triggers the alert. Use this file in your mail. Try sending it as binhex, tar'ed, gzip'ed, uuencoded, etc. For more information visit [116]the Eicar Anti-Virus test file webpage _________________________________________________________________ 4. Download Current versions are available at [117]http://www.amavis.org/download/ _________________________________________________________________ 5. Future Outlook Features to be added to next Version: * simple installation and configuration via script for more systems * apply "sendmail hack" directly in M4 configuration file * content filtering support * modularisation * ... _________________________________________________________________ 6. Bugs * Documentation should be more accurate * ... Send bugreports to: [118]amavis@aachalon.de or to our [119]amavis-bugs mailing list. Prior to this, please read through the files FAQ or BUGS provided and check through the mailing list archive to be sure your bug has not already been discovered. Please include information about the system you are using (eg. Linux, Solaris,...), the OS or distribution release (eg. RedHat 5.2, SuSE 6.0, SUN Solaris 2.6, ...) and anything that might be useful to trace a bug or shortcoming (like exerpts from your logfile which ususally is /var/log/scanmails/logfile and/or /var/log/maillog)... 7. Disclaimer The software is provided as is. Please bear in mind that we have done this in our spare time. While it is as accurate as we could make it there is a reasonable chance that there are mistakes somewhere in here. If you email [120]us and tell us about them we will be happy to fix them but we can't take responsibility for your system. Basically use this at your own risk. 7. Copyright AMaViS - A Mail Virus Scanner (c) 1997..2000 Mogens Kjaer, Carlsberg Laboratory [121]mk@crc.dk, Jürgen Quade [122]quade@amavis.org, Christian Bricart, [123]shiva@aachalon.de, Rainer Link [124]link@suse.de, Lars Hecking [125]lhecking@users.sourceforge.net and others. This program is free software; you can redistribute it and/or modify it under the terms of the [126]GNU General Public License as published by [127]the Free Software Foundation; either version 1, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the [128]GNU General Public License for more details. Product names and various content (including but not limited to audio, video, and graphics) are trademarks of their respective owner. _________________________________________________________________ 8. Credits * initial code Mogens Kjaer * minor modifications * press work Jürgen Quade * minor modifications and enhancements * official Website * official support e-mail adress * packet mainenance Christian Bricart * bug fixes and code improvements * qmail support Chris L. Mason * modifications and enhancements * added support for several anti-virus products * added support for exim and postfix (based on work from Lars Hecking) * product support * thanks to [129]SuSE Germany for funding my work Rainer Link _________________________________________________________________ 9. AMaViS in the Press * 22. Jan 1998 [130]iX - Magazin für professionelle Computertechnik 2/1998 (german) * 21. Jan 1999 iX - Magazin für professionelle Computertechnik 2/1999 (german), page 30 * 25. May 1999 [131]c't Magazin für Computertechnik 11/1999 (german), page 132 ff. (133) * May 2000 freeX 3/2000 (german), page 48ff _________________________________________________________________ 10. History and Changes for a full description of changes have a look at the [132]ChangeLog * Version 0.2.1 (30. Oct 2000) + lot of bug fixes and code improvements + added support for exim, postfix and qmail + added support for more anti-virus products * Version 0.2.0-pre6 (20. Jul 1999) + root exploit fix recode to work with non Bash2 + fix misplaced "fi" in if-clause * Version 0.2.0-pre5 (19. Jul 1999) + fixed possible exploit allows that allowed for malicious users to insert arbitrary commands + updated zipsecure to work with self-extracting ZIP's + optional line in mail header after scanning + AVP support * Version 0.2.0-pre4 (31. Mar 1999) + fixed empty helper application bug ("if [ -x ${prog} ]" always true when $prog=(empty)) + mail gets dumped if there is no program for delivery * Version 0.2.0-pre3 (29. Mar 1999) + added Sophos Anti-Virus scanner support + added new archive handlers + (hopefully) improved configure * Version 0.2.0-pre2 (25. Feb 1999) + fixed some possible loops in handling archives + added some comments in BUGS + changed version numbering in tarball, now conform to GNU * Version 0.2.0pre1 (08. Dec 1998) + switched to GNU-AutoConfig + droped security fix from 0.1.1 in favour to "zipsecure" and "securetar" + H&BEDV AntiVir/X scanner added + enhanced logging via syslogd + many fixes more * Version 0.1.1 (28. Jan 1998) + untar and unzip is now done by user "nobody" -> security fix + ${virusmaildir} (default /root/virus) is now created + Logfile is now REALLY created in specified log-directory * Version 0.1.0 (17. Jan 1998) + first official release + assigned a package name "AMaViS - A Mail Virus Scanner" + package maintenance assigned to Christian Bricart with official email adress [133]amavis@aachalon.de and official Website at [134]http://aachalon.de/AMaViS/ + minor recoding of scanmails + installation enhancements * initial, unsupported base version + never released officially to the public + original code done by Mogens Kjaer, Carlsberg Laboratory, [135]mk@crc.dk + Modified by Jürgen Quade, Softing GmbH, [136]quade@softing.com _________________________________________________________________ $Revision: 1.1.1.1.2.2.2.1 $ $Date: 2001/01/18 19:44:20 $ [137]amavis@aachalon.de References 1. mailto:shiva@aachalon.de 2. mailto:link@suse.de 3. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#intro 4. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#require 5. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#scanners 6. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#mcafee 7. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#drsolomon 8. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#antivir 9. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#sophos 10. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#avp 11. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#vfind 12. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#trend 13. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#cai 14. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#fsecure 15. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#MTA 16. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#sendmail 17. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#qmail 18. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#postfix 19. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#exim 20. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#mime 21. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#metamail 22. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#reformime 23. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#decomp 24. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#uudecode 25. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#uncompress 26. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#gunzip 27. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#unzip 28. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#unarj 29. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#unrar 30. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#xbin 31. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#lha 32. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#bunzip2 33. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#zoo 34. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#arc 35. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#freeze 36. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#tnef 37. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#ftype 38. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#file 39. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#install 40. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#instsoft 41. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#modsendmail 42. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#modsendmailedit 43. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#modsendmailmc 44. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#test 45. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#download 46. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#outlook 47. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#bugs 48. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#disclaimer 49. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#copyright 50. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#credits 51. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#press 52. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#history 53. http://www.linux.org/ 54. http://www.nai.com/ 55. http://ftpsearch.lycos.com/cgi-bin/search?query=naix3.%2B%5C.tar&doit=Search&type=Regular+expression+search&hits=50&sort=date 56. http://ftpsearch.lycos.com/cgi-bin/search?query=nhp3.%2B%5C.tar&doit=Search&type=Regular+expression+search&hits=50&sort=date 57. http://ftpsearch.lycos.com/cgi-bin/search?query=nlxb3.%2B%5C.tar&doit=Search&type=Regular+expression+search&hits=50&sort=date 58. http://ftpsearch.lycos.com/cgi-bin/search?query=nncr3.%2B%5C.tar&doit=Search&type=Regular+expression+search&hits=50&sort=date 59. http://ftpsearch.lycos.com/cgi-bin/search?query=nss3.%2B%5C.tar&doit=Search&type=Regular+expression+search&hits=50&sort=date 60. ftp://ftp.mcafee.com/pub/antivirus/datfiles/3.x/ 61. http://ftpsearch.lycos.com/cgi-bin/search?form=medium&query=vhpx4.%2B%5C.tar%5C.Z&doit=Search&type=Regular+expression+search&hits=50&sort=date 62. http://ftpsearch.lycos.com/cgi-bin/search?form=medium&query=vlnx4.%2B%5C.tar%5C.Z&doit=Search&type=Regular+expression+search&hits=50&sort=date 63. http://ftpsearch.lycos.com/cgi-bin/search?form=medium&query=vsco4.%2B%5C.tar%5C.Z&doit=Search&type=Regular+expression+search&hits=50&sort=date 64. http://ftpsearch.lycos.com/cgi-bin/search?form=medium&query=vsun4.%2B%5C.tar%5C.Z&doit=Search&type=Regular+expression+search&hits=50&sort=date 65. http://www.nai.com/asp_set/buy_try/try/products_evals.asp 66. http://www.nai.com/asp_set/download/dats/mcafee_4x.asp 67. http://www.mcafeeb2b.com/asp_set/anti_virus/updates/virus_4d.asp 68. http://www.nai.com/ 69. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#nai4 70. http://www.hbedv.com/ 71. mailto:linux_support@antivir.de 72. http://www.sophos.com/ 73. http://www.sophos.com/products/antivirus/savunix.html 74. http://www.sophos.com/downloads/products/index.cgi/next?GroupsID=5 75. http://www.avp.ru/ 76. http://www.kasperskylab.ru/eng/products/eval.asp 77. http://www.kasperskylab.ru/eng/products/eval.asp 78. http://www.cyber.com/ 79. http://www.cyber.com/products/ 80. http://www.antivirus.com/ 81. http://www.antivirus.com/free_tools/linux/ 82. http://www.cai.com/products/inoculateit.htm 83. ftp://ftp.cai.com/pub/getbbs/ 84. http://www.eu.f-secure.com/download-purchase/ 85. http://www.sendmail.org/ 86. http://www.qmail.org/ 87. http://www.postfix.org/ 88. http://www.exim.org/ 89. ftp://ftp.funet.fi/pub/Linux/PEOPLE/Linus/net-source/mail/tools/ 90. http://www.flounder.net/~mrsam/maildrop/ 91. ftp://ftp.gnu.org/gnu/sharutils/ 92. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#gunzip 93. ftp://sunsite.unc.edu/pub/Linux/utils/compress/compress.tar.Z 94. ftp://sunsite.unc.edu/pub/Linux/compress/gzip-1.2.4L.tar.gz 95. ftp://suntite.unc.edu/pub/Linux/utils/compress/gzip-pentium-elf.gz 96. ftp://sunsite.unc.edu/pub/Linux/utils/compress/ 97. ftp://sunsite.unc.edu/pub/Linux/utils/compress/ 98. ftp://sunsite.unc.edu/pub/Linux/utils/compress/ 99. ftp://sunsite.unc.edu/pub/packages/TeX/tools/xbin/xbinunix.c 100. http://www2m.biglobe.ne.jp/~dolphin/lha/prog/ 101. http://shibuya.cool.ne.jp/lha/ 102. http://sources.redhat.com/bzip2/ 103. ftp://metalab.unc.edu/pub/Linux/utils/compress/ 104. ftp://ftp.uu.net/pub/archiving/ 105. ftp://metalab.unc.edu/pub/Linux/utils/compress/ 106. http://metalab.unc.edu/pub/Linux/utils/compress/ 107. http://world.std.com/~damned/software.html 108. ftp://ftp.astron.com/pub/file/ 109. ftp://ftp.gw.com/pub/unix/file/ 110. ftp://ftp.funet.fi/pub/unix/tools/file/ 111. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#outlook 112. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#download 113. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#modsendmail 114. file://localhost/home/rainer/amavis-cvs/amavis/doc/amavis.html#test 115. http://www.eicar.org/download/eicar.com 116. http://www.eicar.org/anti_virus_test_file.htm 117. http://www.amavis.org/download/ 118. mailto:amavis@aachalon.de 119. http://sourceforge.net/mail/?group_id=6006 120. mailto:amavis@aachalon.de 121. mailto:mk@crc.dk 122. mailto:quade@amavis.org 123. mailto:shiva@aachalon.de 124. mailto:link@suse.de 125. mailto:lhecking@users.sourceforge.net 126. http://www.gnu.org/copyleft/gpl.html 127. http://www.gnu.org/fsf/fsf.html 128. http://www.gnu.org/copyleft/gpl.html 129. http://www.suse.de/ 130. http://www.heise.de/ix/artikel/1998/02/136/ 131. http://www.heise.de/ct/ 132. http://www.amavis.org/ChangeLog.txt 133. mailto:amavis@aachalon.de 134. http://.aachalon.de/AMaViS/ 135. mailto:mk@crc.dk 136. mailto:quade@softing.com 137. mailto:amavis@aachalon.de