Re: [Evolution] Deleting infected messages

[Reid Thompson <Reid Thompson ateb com>]

On Wed, 2012-08-29 at 12:50 +0000, Reid Thompson wrote:
> On Wed, 2012-08-29 at 10:56 +0200, Paul Menzel wrote:
> > It is not as easily anymore, if Jonathan has more than letâs say ten
> > messages. So just using `rm` on the command line and telling Evolution
> > to update something would save a lot of time I guess.
> >
> >
> > Thanks,
> >
> > Paul
>
> I used to have a filter that piped incoming email to this script.  If
> the script returns 1 then process the message as infected.
>
> It may very well need tweaking -- i've not used it in a long time.
> the commented out fp calls write results out to a logfile -- usefull for
> debugging and when you first start using it.  The commented puts calls
> are there for when I cat'd emails in from the command line to test ala
>
>        $ cat filename | rubyclamav.rb
>
>
> The script
>
> $ cat rubyclamav.rb 
> #!/usr/bin/ruby
> #
> require 'socket'
> #fp = File.open("/var/log/rubyclamav/rubyoutclam_#{Process.pid}.log", "a")
> START_TIME=Time.now
> sendSock = UNIXSocket.open('/var/run/clamav/clamd.sock')
> #sendSock = UNIXSocket.open('/var/run/clamav/clamd.ctl')
> sendSock.puts("STREAM")
> retStr = sendSock.gets
> tag, val = retStr.split
> sendSock1 =  TCPSocket.open('localhost',"#{val}")
> ####res = $stdin.read
> sendSock1.write($stdin.read)
> sendSock1.close
> retStr = sendSock.gets
> pt = Time.now - START_TIME
> ####puts "#{retStr}"
> ####fp.write("#{res}\n")
> #fp.write("#{retStr}\n")
> #fp.write("ProcessTime = #{pt}\n")
> #fp.close
> if retStr.match("FOUND") then
>         system("zenity --warning --title=\"Evolution: Virus detected\" --text=\"#{retStr}\" &")
>     exit 1
> else
>     exit 0
> end

once you have the filter setup to handle infected messages like you
want, you can CTRL-A a folder and CTRL-Y to run them all through your
filters.  If you have other filters that you don't want to apply to your
emails a second time - temporarily turn them off.