1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
|
<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
<meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>cyr_virusscan — Cyrus IMAP 3.12.1 documentation</title>
<link rel="stylesheet" href="../../../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/css/theme.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/graphviz.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/cyrus.css" type="text/css" />
<script data-url_root="../../../../" id="documentation_options" src="../../../../_static/documentation_options.js"></script>
<script src="../../../../_static/jquery.js"></script>
<script src="../../../../_static/underscore.js"></script>
<script src="../../../../_static/_sphinx_javascript_frameworks_compat.js"></script>
<script src="../../../../_static/doctools.js"></script>
<script src="../../../../_static/sphinx_highlight.js"></script>
<script src="../../../../_static/js/theme.js"></script>
<link rel="index" title="Index" href="../../../../genindex.html" />
<link rel="search" title="Search" href="../../../../search.html" />
<link rel="next" title="cyr_withlock_run" href="cyr_withlock_run.html" />
<link rel="prev" title="cyr_userseen" href="cyr_userseen.html" />
</head>
<body class="wy-body-for-nav">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
<div class="wy-side-scroll">
<div class="wy-side-nav-search" >
<a href="../../../../index.html" class="icon icon-home">
Cyrus IMAP
</a>
<div class="version">
3.12.1
</div>
<div role="search">
<form id="rtd-search-form" class="wy-form" action="../../../../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
<p class="caption" role="heading"><span class="caption-text">Cyrus IMAP</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../../../download.html">Download</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../quickstart.html">Quickstart Guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../overview.html">Overview</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../setup.html">Setup</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../../../operations.html">Operations</a><ul class="current">
<li class="toctree-l2 current"><a class="reference internal" href="../index.html">Man pages</a><ul class="current">
<li class="toctree-l3"><a class="reference internal" href="../index.html#configuration-files">(5) Configuration Files</a></li>
<li class="toctree-l3 current"><a class="reference internal" href="../index.html#system-commands">(8) System Commands</a><ul class="current">
<li class="toctree-l4"><a class="reference internal" href="arbitron.html"><strong>arbitron</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="calalarmd.html"><strong>calalarmd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="chk_cyrus.html"><strong>chk_cyrus</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ctl_conversationsdb.html"><strong>ctl_conversationsdb</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ctl_cyrusdb.html"><strong>ctl_cyrusdb</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ctl_deliver.html"><strong>ctl_deliver</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ctl_mboxlist.html"><strong>ctl_mboxlist</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ctl_zoneinfo.html"><strong>ctl_zoneinfo</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cvt_cyrusdb.html"><strong>cvt_cyrusdb</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cvt_xlist_specialuse.html"><strong>cvt_xlist_specialuse</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_buildinfo.html"><strong>cyr_buildinfo</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_dbtool.html"><strong>cyr_dbtool</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_deny.html"><strong>cyr_deny</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_df.html"><strong>cyr_df</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_expire.html"><strong>cyr_expire</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_info.html"><strong>cyr_info</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_ls.html"><strong>cyr_ls</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_synclog.html"><strong>cyr_synclog</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_userseen.html"><strong>cyr_userseen</strong></a></li>
<li class="toctree-l4 current"><a class="current reference internal" href="#"><strong>cyr_virusscan</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyr_withlock_run.html"><strong>cyr_withlock_run</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyradm.html"><strong>cyradm</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="cyrdump.html"><strong>cyrdump</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="deliver.html"><strong>deliver</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="fetchnews.html"><strong>fetchnews</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="fud.html"><strong>fud</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="httpd.html"><strong>httpd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="idled.html"><strong>idled</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="imapd.html"><strong>imapd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ipurge.html"><strong>ipurge</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="lmtpd.html"><strong>lmtpd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="lmtpproxyd.html"><strong>lmtpproxyd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="masssievec.html"><strong>masssievec</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="master.html"><strong>master</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mbexamine.html"><strong>mbexamine</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mbpath.html"><strong>mbpath</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mbtool.html"><strong>mbtool</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mkimap.html"><strong>mkimap</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mknewsgroups.html"><strong>mknewsgroups</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="mupdate.html"><strong>mupdate</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="nntpd.html"><strong>nntpd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="notifyd.html"><strong>notifyd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="pop3d.html"><strong>pop3d</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="pop3proxyd.html"><strong>pop3proxyd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="promstatsd.html"><strong>promstatsd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="proxyd.html"><strong>proxyd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ptdump.html"><strong>ptdump</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ptexpire.html"><strong>ptexpire</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="ptloader.html"><strong>ptloader</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="quota.html"><strong>quota</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="reconstruct.html"><strong>reconstruct</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="rehash.html"><strong>rehash</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="relocate_by_id.html"><strong>relocate_by_id</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="sievec.html"><strong>sievec</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="sieved.html"><strong>sieved</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="smmapd.html"><strong>smmapd</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="squatter.html"><strong>squatter</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="sync_client.html"><strong>sync_client</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="sync_reset.html"><strong>sync_reset</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="sync_server.html"><strong>sync_server</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="timsieved.html"><strong>timsieved</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="tls_prune.html"><strong>tls_prune</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="translatesieve.html"><strong>translatesieve</strong></a></li>
<li class="toctree-l4"><a class="reference internal" href="unexpunge.html"><strong>unexpunge</strong></a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="../index.html#user-commands">(1) User Commands</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../admin.html">Administrator Guide</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../faq.html">Frequently Asked Questions</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../../../developers.html">Developers</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../support.html">Support/Community</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Cyrus SASL</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="http://www.cyrusimap.org/sasl">Cyrus SASL</a></li>
</ul>
</div>
</div>
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="../../../../index.html">Cyrus IMAP</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content">
<div role="navigation" aria-label="Page navigation">
<ul class="wy-breadcrumbs">
<li><a href="../../../../index.html" class="icon icon-home" aria-label="Home"></a></li>
<li class="breadcrumb-item"><a href="../../../../operations.html">Operations</a></li>
<li class="breadcrumb-item"><a href="../index.html">Man pages</a></li>
<li class="breadcrumb-item active"><strong>cyr_virusscan</strong></li>
<li class="wy-breadcrumbs-aside">
<a href="https://github.com/cyrusimap/cyrus-imapd/blob/master/docsrc/imap/reference/manpages/systemcommands/cyr_virusscan.rst" class="fa fa-github"> Edit on GitHub</a>
</li>
</ul>
<hr/>
</div>
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
<div itemprop="articleBody">
<section id="cyr-virusscan">
<span id="imap-reference-manpages-systemcommands-cyr-virusscan"></span><h1><strong>cyr_virusscan</strong><a class="headerlink" href="#cyr-virusscan" title="Permalink to this heading"></a></h1>
<p>Scan for viruses using configured virus scanner or manage infected messages using search criteria.</p>
<section id="synopsis">
<h2>Synopsis<a class="headerlink" href="#synopsis" title="Permalink to this heading"></a></h2>
<pre class="literal-block"><strong>cyr_virusscan</strong> [ <strong>-C</strong> <em>config-file</em> ] [ <strong>-s</strong> <em>imap-search-string</em> ] [ <strong>-r</strong> [ <strong>-n</strong>] ] [<strong>-v</strong>] [ <em>mboxpattern1</em> ... ]</pre>
</section>
<section id="description">
<h2>Description<a class="headerlink" href="#description" title="Permalink to this heading"></a></h2>
<p><strong>cyr_virusscan</strong> can be used to invoke an external virus scanner (currently
only <a class="reference external" href="https://www.clamav.net/documents/installing-clamav">ClamAV</a> is
supported) to scan specified IMAP mailboxes. If no mboxpattern is given,
<strong>cyr_virusscan</strong> works on all mailboxes.</p>
<p>Alternately, with the <strong>-s</strong> option, the IMAP SEARCH string will be used as a
specification of messages which are <em>assumed</em> to be infected, and will be
treated as such. The virus scanner is not invoked. Useful for removing messages
without a distinct signature, such as Phish.</p>
<p>A table of infected messages will be output.</p>
<p>To remove infected messages, use the <strong>-r</strong> flag. Infected messages will be expunged
from the user's mailbox.</p>
<p>With the notify flag, <strong>-n</strong>, notifications will be appended to the inbox of
the mailbox owner, containing message digest information for the affected mail.
This flag only works in combination with <strong>-r</strong>. The notification message
can by customised by template, for details see <a class="reference internal" href="#notifications">Notifications</a> below.</p>
<p><strong>cyr_virusscan</strong> can be configured to run periodically by cron(8)
via crontab(5) or your preferred method (i.e. /etc/cron.hourly), or by
<a class="reference internal" href="master.html#std-cyrusman-master-8">master(8)</a> via the EVENTS{} section in
<a class="reference internal" href="../configs/cyrus.conf.html#std-cyrusman-cyrus.conf-5">cyrus.conf(5)</a>.</p>
<p><strong>cyr_virusscan</strong> reads its configuration options out of the <a class="reference internal" href="../configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> file unless specified otherwise by <strong>-C</strong>.</p>
<p>Note that Cyrus does not ship with any virus scanners: you need to install
one separately to make use of it with Cyrus.</p>
</section>
<section id="options">
<h2>Options<a class="headerlink" href="#options" title="Permalink to this heading"></a></h2>
<dl class="std option">
<dt class="sig sig-object std" id="cmdoption-cyr_virusscan-C">
<span id="cmdoption-cyr-virusscan-c"></span><span class="sig-name descname"><span class="pre">-C</span></span><span class="sig-prename descclassname"> <span class="pre">config-file</span></span><a class="headerlink" href="#cmdoption-cyr_virusscan-C" title="Permalink to this definition"></a></dt>
<dd><p>Use the specified configuration file <em>config-file</em> rather than the default <a class="reference internal" href="../configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
</dd></dl>
<dl class="std option">
<dt class="sig sig-object std" id="cmdoption-cyr_virusscan-n">
<span id="cmdoption-cyr-virusscan-n"></span><span id="cmdoption-cyr_virusscan-notify"></span><span id="cmdoption-cyr-virusscan-notify"></span><span class="sig-name descname"><span class="pre">-n</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--notify</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-cyr_virusscan-n" title="Permalink to this definition"></a></dt>
<dd><p>Notify mailbox owner of deleted messages via email. This flag is
only operable in combination with <strong>-r</strong>.</p>
</dd></dl>
<dl class="std option">
<dt class="sig sig-object std" id="cmdoption-cyr_virusscan-r">
<span id="cmdoption-cyr-virusscan-r"></span><span id="cmdoption-cyr_virusscan-remove-infected"></span><span id="cmdoption-cyr-virusscan-remove-infected"></span><span class="sig-name descname"><span class="pre">-r</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--remove-infected</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-cyr_virusscan-r" title="Permalink to this definition"></a></dt>
<dd><p>Remove infected messages.</p>
</dd></dl>
<dl class="std option">
<dt class="sig sig-object std" id="cmdoption-cyr_virusscan-s">
<span id="cmdoption-cyr-virusscan-s"></span><span id="cmdoption-cyr_virusscan-search"></span><span id="cmdoption-cyr-virusscan-search"></span><span class="sig-name descname"><span class="pre">-s</span></span><span class="sig-prename descclassname"> <span class="pre">imap-search-string</span></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--search</span></span><span class="sig-prename descclassname"><span class="pre">=imap-search-string</span></span><a class="headerlink" href="#cmdoption-cyr_virusscan-s" title="Permalink to this definition"></a></dt>
<dd><p>Rather than scanning for viruses, messages matching the search
criteria will be treated as infected.</p>
</dd></dl>
<dl class="std option">
<dt class="sig sig-object std" id="cmdoption-cyr_virusscan-v">
<span id="cmdoption-cyr-virusscan-v"></span><span id="cmdoption-cyr_virusscan-verbose"></span><span id="cmdoption-cyr-virusscan-verbose"></span><span class="sig-name descname"><span class="pre">-v</span></span><span class="sig-prename descclassname"></span><span class="sig-prename descclassname"><span class="pre">,</span> </span><span class="sig-name descname"><span class="pre">--verbose</span></span><span class="sig-prename descclassname"></span><a class="headerlink" href="#cmdoption-cyr_virusscan-v" title="Permalink to this definition"></a></dt>
<dd><p>Produce more verbose output</p>
</dd></dl>
</section>
<section id="notifications">
<h2>Notifications<a class="headerlink" href="#notifications" title="Permalink to this heading"></a></h2>
<p>When the <strong>-n</strong> flag is provided, notifications are sent to mailbox owners
when infected messages are removed. One notification is sent per owner,
containing a digest of each message that was deleted from any of their
mailboxes.</p>
<p>The default notification subject is "Automatically deleted mail", which
can be overridden by setting <code class="docutils literal notranslate"><span class="pre">virusscan_notification_subject</span></code> in
<a class="reference internal" href="../configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> to a UTF-8 value.</p>
<p>Each infected message will be described according to the following template:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>The following message was deleted from mailbox '%MAILBOX%'
because it was infected with virus '%VIRUS%'
Message-ID: %MSG_ID%
Date: %MSG_DATE%
From: %MSG_FROM%
Subject: %MSG_SUBJECT%
IMAP UID: %MSG_UID%
</pre></div>
</div>
<p>To use a custom template, create a UTF-8 file containing your desired text
and using the same %-delimited substitutions as above, and set the
<code class="docutils literal notranslate"><span class="pre">virusscan_notification_template</span></code> option in <a class="reference internal" href="../configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> to
its path.</p>
<p>The notification message will be properly MIME-encoded at delivery. Do not
pre-encode the template file or the subject!</p>
<p>When <strong>cyr_virusscan</strong> starts up, if notifications have been requested (with
the <strong>-n</strong> flag), a basic sanity check of the template will be performed
prior to initialising the antivirus engine. If it appears that the
resultant notifications would be undeliverable for some reason,
<strong>cyr_virusscan</strong> will exit immediately with an error, rather than risk
deleting messages without notifying.</p>
</section>
<section id="examples">
<h2>Examples<a class="headerlink" href="#examples" title="Permalink to this heading"></a></h2>
<pre class="literal-block"><strong>cyr_virusscan</strong></pre>
<blockquote>
<div><p>Scan all mailboxes, printing report on the screen. Do not
remove infected messages.</p>
</div></blockquote>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Using ClamAV virus scanner
Loaded 5789330 virus signatures.
Mailbox Name Msg UID Status Virus Name
---------------------------------------- ---------- ------ --------------------------------------------------
user.betty 185395 READ Heuristics.Phishing.Email.SpoofedDomain
user.betty.Bank stuff 9 READ Html.Phishing.Bank-1172
user.betty.Bank stuff 10 READ Html.Phishing.Bank-1172
user.betty.Bank stuff 11 READ Html.Phishing.Bank-1172
Mailbox Name Msg UID Status Virus Name
---------------------------------------- ---------- ------ --------------------------------------------------
user.bovik 17426 READ Email.Trojan.Trojan-1051
</pre></div>
</div>
<pre class="literal-block"><strong>cyr_virusscan</strong> -r -n user/bovik</pre>
<blockquote>
<div><p>Scan mailbox <em>user/bovik</em>, removing infected messages and append
notifications to Bovik's inbox.</p>
</div></blockquote>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Mailbox Name Msg UID Status Virus Name
---------------------------------------- ---------- ------ --------------------------------------------------
user.bovik 17426 READ Email.Trojan.Trojan-1051
</pre></div>
</div>
<blockquote>
<div><p>A message like this would end up in bovik's inbox:</p>
</div></blockquote>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>The following message was deleted from mailbox 'INBOX'
because it was infected with virus 'Email.Trojan.Trojan-1051'
Message-ID: <201308131519.r7DFJM9K083763@tselina.kiev.ua>
Date: Tue, 13 Aug 2013 18:19:22 +0300 (EEST)
From: "FEDEX Thomas Cooper" <thomas_cooper94@themovieposterpage.com>
Subject: Problem with the delivery of parcel
IMAP UID: 17426
</pre></div>
</div>
<pre class="literal-block"><strong>cyr_virusscan</strong> -r -n -s 'SUBJECT "Fedex"' user/bovik</pre>
<blockquote>
<div><p>Search mailbox user/bovik for messages which have Fedex in the
subject line, removing them all, and appending notifications to
Bovik's inbox.</p>
</div></blockquote>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>Mailbox Name Msg UID Status Virus Name
---------------------------------------- ---------- ------ --------------------------------------------------
user.bovik 17185 READ Cyrus Administrator Targeted Removal (Phish, etc.)
user.bovik 17203 READ Cyrus Administrator Targeted Removal (Phish, etc.)
user.bovik 17338 READ Cyrus Administrator Targeted Removal (Phish, etc.)
user.bovik 17373 READ Cyrus Administrator Targeted Removal (Phish, etc.)
user.bovik 19238 READ Cyrus Administrator Targeted Removal (Phish, etc.)
user.bovik 19268 READ Cyrus Administrator Targeted Removal (Phish, etc.)
</pre></div>
</div>
</section>
<section id="history">
<h2>History<a class="headerlink" href="#history" title="Permalink to this heading"></a></h2>
<p>Virus scan support was first introduced in Cyrus version 3.0.</p>
</section>
<section id="files">
<h2>Files<a class="headerlink" href="#files" title="Permalink to this heading"></a></h2>
<p>/etc/imapd.conf</p>
</section>
<section id="see-also">
<h2>See Also<a class="headerlink" href="#see-also" title="Permalink to this heading"></a></h2>
<p><a class="reference internal" href="../configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>, <a class="reference internal" href="master.html#std-cyrusman-master-8">master(8)</a>, <a class="reference external" href="https://www.clamav.net/documents/installing-clamav">ClamAV</a></p>
</section>
</section>
</div>
</div>
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
<a href="cyr_userseen.html" class="btn btn-neutral float-left" title="cyr_userseen" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
<a href="cyr_withlock_run.html" class="btn btn-neutral float-right" title="cyr_withlock_run" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
</div>
<hr/>
<div role="contentinfo">
<p>© Copyright 1993–2025, The Cyrus Team.</p>
</div>
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
</div>
</div>
</section>
</div>
<script>
jQuery(function () {
SphinxRtdTheme.Navigation.enable(true);
});
</script>
</body>
</html>
|
