JPEG Virus

Rick Cooper rcooper at DWFORD.COM
Wed Sep 29 15:17:18 IST 2004


> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Wednesday, September 29, 2004 7:43 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: JPEG Virus
>
>
> At 12:58 29/09/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Wednesday, September 29, 2004 6:22 AM
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: Re: JPEG Virus
> > >
> > >
> > > Has anyone seen any problems rebuilding Mail::ClamAV against
> the 0.80rc3
> > > release? On the system I tried it, the CL_ENCRYPTED #define
> wasn't, so it
> > > wouldn't compile. And using the old one with 0.80rc3 was
> failing with lots
> > > of "ENCRYPTED" error reports and MailScanner said the virus
> scanner was
> > > failing.
> > >
> > > So I had to stop using the clamavmodule and use clamav instead.
> >
> >I have rc3 and it's not a problem. The CL_ENCRYPTED is obsolete but
> >supported. the author needs to update that module one of these days to
> >support all the changes and addtions.
> >
> >/* aliases for backward compatibility */
> >#define CL_RAW          CL_SCAN_RAW
> >#define CL_ARCHIVE      CL_SCAN_ARCHIVE
> >#define CL_MAIL         CL_SCAN_MAIL
> >#define CL_DISABLERAR   CL_SCAN_DISABLERAR
> >#define CL_OLE2         CL_SCAN_OLE2
> >#define CL_ENCRYPTED    CL_SCAN_ENCRYPTED
> >
> >Odd that your clamav.h wouldn't have that same section?
>
> It has that section, but then does not define CL_SCAN_ENCRYPTED anywhere.
> Looks like I'm not the only person with this problem, either.

I stupidly did not try and recompile my working Mail::ClamAV. You are right,
and there are two other defines missing as well. the following patch to
clamav.h will correct the typo that is causing the encrypted errors and add
the two missing defines, that you don't use but will still stop the module
from compiling. The module doesn't use them either (CL_NUM_CHILDS and
CL_MIN_LENGTH)

------------------------------ begin snip below ---------------------

*** clamav.h    Wed Sep 29 08:58:05 2004
--- clamav.h.new        Wed Sep 29 08:57:58 2004
***************
*** 84,92 ****
  #define CL_ARCHIVE    CL_SCAN_ARCHIVE
  #define CL_MAIL               CL_SCAN_MAIL
  #define CL_DISABLERAR CL_SCAN_DISABLERAR
  #define CL_OLE2               CL_SCAN_OLE2
! #define CL_ENCRYPTED    CL_SCAN_ENCRYPTED


  struct cli_bm_patt {
      char *pattern, *virname, *offset;
--- 84,96 ----
  #define CL_ARCHIVE    CL_SCAN_ARCHIVE
  #define CL_MAIL               CL_SCAN_MAIL
  #define CL_DISABLERAR CL_SCAN_DISABLERAR
  #define CL_OLE2               CL_SCAN_OLE2
! /* #define CL_ENCRYPTED    CL_SCAN_ENCRYPTED */
! #define CL_ENCRYPTED    CL_SCAN_BLOCKENCRYPTED
! #define CL_NUM_CHILDS 256
! #define CL_MIN_LENGTH 2
!


  struct cli_bm_patt {
      char *pattern, *virname, *offset;

--------------- end snip -----------------------

Sorry for not paying closer attention to what you actually said. I sent
along a note about this to the clamav user list as well.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



More information about the MailScanner mailing list