MailScanner response to ClamAV output on empty attachments

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The message is a bit alarmist, but it could well be a result of the
ClamAV guys seriously changing their output format or something like
that, so I try to make sure you folks keep me ahead of the game.

To get rid of this one, change SweepViruses.pm line 2333 to this
  return 0 if /Empty file\.?$/;
which is 2 characters different from what it said before.

Jim Holland wrote:

>Hi Julian
>
>I am currently using:
>
>        Sendmail 8.13.1
>        MailScanner version 4.40.11
>        ClamAV 0.84rc1
>
>I often notice the following types of entries in the maillog file:
>
>Apr 17 09:50:17 mail MailScanner[1923]: ProcessClamAVOutput: unrecognised line
>"/var/spool/MailScanner/incoming/1923/./j3H7kTGh004659/msg-1923-68.txt:
>Empty file". Please contact the authors!
>
>Apr 17 09:53:53 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised line
>"/var/spool/MailScanner/incoming/1954/./j3H7qfHA008171/msg-1954-78.txt:
>Empty file". Please contact the authors!
>
>Apr 17 09:54:52 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised
>line "/var/spool/MailScanner/incoming/1954/./j3H7ru4K008605/readme.pif:
>Empty file". Please contact the authors!
>
>As far as I can see, these are simply redundant reports by MailScanner
>when an empty attachment is found.  The notice "Please contact the
>authors!" seems a little alarmist unless there are some situations where
>action really does need to be taken.  May I suggest that it would be
>better not to scan empty attachments at all?  That would save time and
>also avoid the above error message.
>
>Regards
>
>Jim Holland
>System Administrator
>MANGO - Zimbabwe's non-profit e-mail service
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!