Antivir and Clam patches

[Julian Field]

<x-flowed>
There appears to be some confusion over the 2 patches I recently issued, 
one for support of the new version of Antivir and one for better RAR 
support for a very recent RAR format with ClamAV.

Attached to this message is a patch file for SweepViruses.pm which applies 
both patches.
When you apply the patch, it may say the one of the patches is already 
applied, in which case skip that one and just apply the other one.

cd /usr/lib/MailScanner/MailScanner
patch < SweepViruses.pm.clam-antivir.patch

Then completely stop and restart MailScanner.

Please let me know if
1) This patch makes Clam spot the new RAR format properly
and/or
2) Support for the new Antivir now works properly.


At 10:59 13/08/2004, you wrote:
>On Fri, 13 Aug 2004, Dörfler Andreas wrote:
> > the sweepviruses.pm.patch ?
> > the file from
> > 
> http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=rar_mit_
> > eicar
> > still passes ms and clamd without getting blocked
> >
> > but looks like it´s a problem from clamav ...
> >
> > ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming
> > /5297/./i7D8XaSe006363/eicar.rar: RAR module failure". Please contact the
> > authors!

You will still get some of this output, but it should detect the virus in 
the RAR file. You will need to have told the clamav-wrapper script to use 
the external unrar command.

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>