Not finding viruses but reporting clean

[Fred Dick]

Traced the no mail to an alias problem after updating Sendmail.

FD

At 10:01 AM 7/22/02 -0600, you wrote:

>I sent a test message with a virus (Klez) attached from an outside ISP to
>myself at the Mailscanner protected site.
>
>The mail showed it had an attachment before I opened it. When I opened it
>there was no attachment. It also said, Found to be clean.
>
>I also do not receive any system email alerts regarding that or any other
>virus.
>
>Went to /var/spool/MailScanner/quarantine/20020722 and found some other
>viruses but not my test virus.
>
>Where do I go from here with troubleshooting? Test virus has gone into a
>black hole and I'm not getting any email notifications.
>
>Thanks, Fred
>
>At 12:32 PM 7/20/02 +0100, you wrote:
>
>>Please can you tell us rather more about your problem?
>>All you have shown is that "sophoswrapper" is apparently set up okay.
>>
>>At 22:44 19/07/2002, you wrote:
>>>Gurus,
>>>
>>>Problem:
>>>
>>>Sendmail reports -- X-ECS-MailScanner: Found to be clean
>>>but Mailscanner not detecting any viruses in enterprise.
>>>
>>>Thanks,
>>>
>>>Fred
>>>
>>>++++++++++++++++++++++++++++++
>>>
>>>Sendmail ver: Sendmail 8.8.8+Sun/8.8.8;
>>>
>>>++++++++++++++++++++++++++++++
>>>
>>>Sophos ver:
>>>
>>>xxxx:/opt/mailscanner/etc*> sweep -v
>>>SWEEP virus detection utility
>>>Copyright (c) 1989,2002 Sophos Plc, www.sophos.com
>>>
>>>System time 15:39:15, System date 19 July 2002
>>>
>>>Product version           : 3.59
>>>Engine version            : 2.5
>>>User interface version    : 2.03.076
>>>Platform                  : Solaris/SPARC
>>>Released                  : 01 July 2002
>>>Total viruses (with IDEs) : 74471
>>>
>>>++++++++++++++++++++++++++++++
>>>
>>>xxxx:/opt/mailscanner/bin*> check_mailscanner
>>>Running with pid 20624
>>>
>>>++++++++++++++++++++++++++++++
>>>
>>>xxxx:/etc/init.d*> /opt/sophos/bin/sophoswrapper /opt/sophos
>>>SWEEP virus detection utility
>>>Version 3.59, July 2002 [Solaris/SPARC]
>>>Includes detection for 74506 viruses, trojans and worms
>>>Copyright (c) 1989,2002 Sophos Plc, www.sophos.com
>>>
>>>System time 15:26:55, System date 19 July 2002
>>>
>>>IDE directory is: /opt/sophos/ide
>>>
>>>Using IDE file kitro-d.ide
>>>Using IDE file fret-fam.ide
>>>Using IDE file opey-bc.ide
>>>Using IDE file tinit-b.ide
>>>Using IDE file nahata-f.ide
>>>Using IDE file momac-a.ide
>>>Using IDE file datom-a.ide
>>>Using IDE file gunsan-a.ide
>>>Using IDE file mark-kr.ide
>>>Using IDE file floodo.ide
>>>Using IDE file calil.ide
>>>Using IDE file kwbot-a.ide
>>>Using IDE file duni-a.ide
>>>Using IDE file bajar.ide
>>>Using IDE file metrion.ide
>>>Using IDE file zoek-d.ide
>>>Using IDE file scalper.ide
>>>Using IDE file dotor.ide
>>>Using IDE file dest-j.ide
>>>Using IDE file yaha-e.ide
>>>Using IDE file higuy-a.ide
>>>Using IDE file fishleta.ide
>>>Using IDE file perrun-a.ide
>>>Using IDE file chir-a.ide
>>>Using IDE file cup-a.ide
>>>Using IDE file chickf.ide
>>>
>>>Quick Sweeping
>>>
>>>
>>>3 files swept in 1 second.
>>>No viruses were discovered.
>>>End of Sweep.
>>
>>--
>>Julian Field                Teaching Systems Manager
>>jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
>>Tel. 023 8059 2817          University of Southampton
>>                             Southampton SO17 1BJ