question about Kaspersky

[Nick Phillips]

On Wed, Jan 09, 2002 at 05:43:22PM +0100, Ronny Bremer wrote:
> I was trying to get KAV working with the latest code of MailScanner. It
> does detect viruses but as of today KAV is unable to disinfect/delete
> viruses from mail archives or packed files.

> What troubles me though, if KAV is able to detect a virus in one of the
> mail attachments, can't sweep.pl remove it during the second run of the
> scanner (after checking for bad file names and trying to disinfect)?

> That way even though the virus scanner was unable to delete the file it
> will be still gone. What happened to me is that the mail passed
> MailScanner even though it was infected!

OK, well this certainly shouldn't happen. The way mailscanner should work when
trying to disinfect is to:

1) run the scanner on all attachments;

2) run the disinfector over them if any infections were found;

3) rescan all attachments;

4) send the message on without any still-infected attachments.


I wasn't able to do a decent test of kaspersky, as the version I have won't
disinfect anyway, so it'll be good to get this sorted out properly.

Could you send me a copy of the still-infected message (with all headers)
and all the syslog messages generated by mailscanner while processing it,
please?


Cheers,


Nick
--
Nick Phillips -- nwp at lemon-computing.com
Be careful!  UGLY strikes 9 out of 10!