ClamAV module

[Rick Cooper]

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Martin Hepworth
> Sent: Wednesday, March 03, 2004 10:50 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: ClamAV module
>
>
> only Mail::clamav i find at the moment is 0.06 which
> doesn't seem to
> work..just sits there after initialisting
> SophosSavi.... works on debug
> mode so I dunno why?
>
> anyone got a tar of 0.04 I can have to try that? Mail
> me direct of you
> have to save clogging the list.

I am using the latest 0.06 and it works fine:

Mar  3 11:23:37 srv2 MailScanner[17017]: Virus Scanning: F-Prot
found virus EICAR_Test_File
Mar  3 11:23:37 srv2 MailScanner[17017]:
/var/spool/mailscanner/incoming/17017/1AyZ9e-0004QW-EQ/eicar.com
Infection: EICAR_Test_File
Mar  3 11:23:37 srv2 MailScanner[17017]: Virus Scanning: F-Prot
found virus EICAR_Test_File
Mar  3 11:23:37 srv2 MailScanner[17017]: Completed scanning by
f-prot
Mar  3 11:23:37 srv2 MailScanner[17017]: Virus Scanning: F-Prot
found 2 infections
Mar  3 11:23:37 srv2 MailScanner[17017]: Commencing scanning by
clamavmodule...
Mar  3 11:23:37 srv2 MailScanner[17017]: INFECTED::
Eicar-Test-Signature:: ./1AyZ9e-0004QW-EQ/eicar_com.zip
Mar  3 11:23:37 srv2 MailScanner[17017]: INFECTED::
Eicar-Test-Signature:: ./1AyZ9e-0004QW-EQ/eicar.com
Mar  3 11:23:37 srv2 MailScanner[17017]: Completed scanning by
clamavmodule
Mar  3 11:23:37 srv2 MailScanner[17017]: Virus Scanning: ClamAV
Module found 2 infections
Mar  3 11:23:37 srv2 MailScanner[17017]: Infected message
1AyZ9e-0004QW-EQ came from 192.168.1.3
Mar  3 11:23:37 srv2 MailScanner[17017]: Virus Scanning: Found 2
viruses
Mar  3 11:23:37 srv2 MailScanner[17017]: Filename Checks:
Windows/DOS Executable (1AyZ9e-0004QW-EQ eicar.com)

Note both f-prot and clamavmodule reported both the Eicar
signatures, the previous version was broken, more or less, but
that problem was fixed (I checked for the lines related to the
missing file) and obviously works now.

>
> Ta
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Steve Freegard wrote:
> > Hi Martin,
> >
> > I don't think it matters at all - this morning I
> just upgraded Clam to .67
> > as I realised I'd downloaded it but not installed it (Duh!).
> >
> > I was already running the Mail::ClamAV module so to
> be on the safe side I
> > stopped MS just prior to the 'make install' of .67
> and installed the latest
> > Mail::ClamAV via CPAN at the same time, just in case
> the libraries had
> > changed at all.
> >
> > Working nicely so far...
> >
> > Kind regards,
> > Steve.
> >
> >
> >>-----Original Message-----
> >>From: Martin Hepworth [mailto:martinh at SOLID-STATE-LOGIC.COM]
> >>Sent: 03 March 2004 10:31
> >>To: MAILSCANNER at JISCMAIL.AC.UK
> >>Subject: ClamAV module
> >>
> >>
> >>Guys
> >>
> >>Which version of the tjhe clamAVmodule should I be
> using. I recall
> >>something about one of the versions not working properly with
> >>MS, but i
> >>can't see anything on the archives.
> >>
> >>(btw - running MS 4.28.2-2 and clamav 0.67)
> >>
> >>
> >>--
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>*****************************************************
> *****************
> >>
> >>This email and any files transmitted with it are
> confidential and
> >>intended solely for the use of the individual or
> entity to whom they
> >>are addressed. If you have received this email in
> error please notify
> >>the system manager.
> >>
> >>This footnote confirms that this email message has been swept
> >>for the presence of computer viruses and is believed
> to be clean.
> >>
> >>*****************************************************
> *****************
> >>
> >
> >
> > --
> > This email and any files transmitted with it are
> confidential and
> > intended solely for the use of the individual or
> entity to whom they
> > are addressed. If you have received this email in
> error please notify
> > the sender and delete the message from your mailbox.
> >
> > This footnote also confirms that this email message
> has been swept by
> > MailScanner (www.mailscanner.info) for the presence
> of computer viruses.
>
> *******************************************************
> ***************
>
> This email and any files transmitted with it are
> confidential and
> intended solely for the use of the individual or
> entity to whom they
> are addressed. If you have received this email in
> error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed
> to be clean.
>
> *******************************************************
> ***************
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>