Clam AV for Apple Mail

go straight to the file section below

Introduction

To my best knowledge, viruses and trojans still pose no practical danger at all to Mac OS X; however, since they are distributed excessively from infected Windows machines via e-mail, and since many service providers still do not perform reasonable virus checking, it might be useful to have a reliable filter to get rid of such mails automatically.

Commercial software like Norton AntiVirus appears to cause more problems than it might solve, besides I assume it is probably not necessary to have a scanner running in the background all the time and consuming system resources, when all that is necessary is only incoming mails to be scanned.

This package contains an AppleScript which can be called from the Mail application for every incoming e-mail, scanning the mail and moving it to a special folder. This happens only on demand, so there are no background applications interfering with the OS or similar. In addition, the script can be used to monitor the web browser's downloads folder or a special hot folder, for example.

Further, the package includes the munpack utility used to unpack mail attachments, and a compiled version of the Clam AV anti virus software.

If you want a good GUI for Clam AV allowing you to configure and use it very comfortably, get clamXav by Mark Allan (especially since this package here is not maintained very carefully anymore). The script and the munpack utility are also available separately, without an installer package (instructions see below).

Important note / Disclaimer: the script and these instructions are supplied as is without warranties of any kind. Use at your own risk.

Instructions

All the software was built for OS X 10.4/Tiger, but should work in 10.3/Panther, too, though it was not extensively tested. Note that this is not a Universal Binary distribution, so it is probably not working too well on Intel Macs (the AppleScript of course should work).

There are 2 options:

• Download and install the complete installer package (disk image, 3.3MB), and
• don't forget to read the ReadMe file.

or

• download the AppleScript, unpack it and move it to a suitable destination, i.e. /Library/Scripts/Folder Action Scripts or ~/Library/Scripts/Folder Action Scripts,
  and download and install clamXav, or get Clam AV and build it yourself.
• Create a new rule in Mail: Preferences/Rules/Add Rule; give it a descriptive name (the default is VirusCheck), and use these settings:

  if any of the following conditions are met:
  Every Message
  Run AppleScript: (choose the location of the script)

• Create a mailbox named "Infected" (this can be customized in the script (property infectedMailbox).
• For unpacking encoded e-mails, the script relies on either Stuffit Expander, which has the advantage that it lets the scanner look into .sit files, or the munpack utility, which works faster and in the background. Which of the two options will be used can be set in the AppleScript (property useStuffit).
  If you don't use darwinports, you can download a compiled version of munpack here; Open a terminal and unpack it with sudo tar -xPzf (to /usr/local/bin by default). I have not tested it yet for compatibility; and I hope I don't infringe any copyrights this way...
• The script assumes clamscan to be located in /usr/local/clamAV/bin/ (the location chosen by the installer package), if you use clamXav or a custom build, set the property clamscanCMD in the script accordingly.
• Putting the script into Folder Action Scripts allows you to attach the VirusChecker script for example to the downloads folder of your browser, so that every downloaded file is scanned and moved to the Trash, if necessary.
• This way you can also create a hot folder on which to drop files you want to have scanned.
• If a suspicious file is found which might contain a virus, a message is written to /var/log/system.log; you can view it with the Console application.
• If the property showAlertDialog is set to true, an alert box will pop in case of a suspicious file being found.
• The AppleScript should be easily modifiably for special needs.
• Every AV software can only be as effective as its virus definitions, which means they should be updated frequently; another possibility is to do this with the clamXav GUI.

Credits

There's a lot of credits to give to other people — the Clam AV project / clamXav developed by Mark Allan / mpack/munpack written by John G. Myers, hosted at darwinports / the (unknown) author of the original public domain AppleScript.
I only modified the AppleScript and added some features (my first project involving AppleScript by the way, so if there are any suggestions for improvements, please let me know!)

More details can be found in the AppleScript itself.

Files

• complete installer package

  disk image, 3.3MB; SHA1 = 6de00157bef93e4f0845d3619141902fa88a02e1

• VirusChecker AppleScript

  zipped, 16kB; SHA1 = 83c1c5c67d4fdddde3a9a04a7e77f3a651719ddf

• mpack/munpack

  gzipped tar, 59kB; SHA1 = 93c7ea9a80997460ad6cb28d8dd9ce926dc56182