ClamAV and MailScanner Bug

[Chris Stone]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Wednesday 04 May 2005 02:04 am, Julian Field wrote:
> On 4 May 2005, at 00:16, Chris Stone wrote:
> > I am seeing problems under OSX:
> >
> > May  3 18:56:29 g5
> > MailScanner[1898]: /private/var/spool/MailScanner/incoming/
> > 1898/./9F050BA0A85C/error-mail_info.zip:
> > Worm.Sober.P FOUND
> > May  3 18:56:29 g5 MailScanner[1898]: Virus Scanning: ClamAV found 1
> > infections
> > May  3 18:56:30 g5 MailScanner[1898]: Virus Scanning completed at
> > 37432 bytes
> > per second
> > May  3 18:56:30 g5 MailScanner[1898]: Requeue: 9F050BA0A85C to
> > C3AB7BA0A920
> > May  3 18:56:30 g5 MailScanner[1898]: Uninfected: Delivered 1 messages
> > May  3 18:56:30 g5 MailScanner[1898]: Virus Processing completed at
> > 74864
> > bytes per second
> > May  3 18:56:30 g5 MailScanner[1898]: Disinfection completed at
> > 74864 bytes
> > per second
> > Seems to only still deliver the Sober viruses - all the others are
> > caught as
> > above, but not delivered. This client is running MS 4.34.8 and
> > ClamAV 0.83.
> > Am going to have them update to the latest MS stable release and
> > see if they
> > still have this issue.
>
> Can someone send me one of the troublesome messages please?
> Easiest way is to put it on the web and mail me the URL.

I'll see if I can get one and do that. Since MS is not blocking them, I don't
have the full messages on the server to pull -  only the headers (using
MailWatch).

But, while other viruses are being properly blocked by MS, it's only these
Worm.Sober.P viruses that ClamAV is detecting, MS is seeing that, but stating
it's disinfected and queuing it up for delivery.

Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!