ClamAV and MailScanner Bug

[Martin Hepworth]

Chris (and anyone else)

If you have an example ofthe missed sober.p's can you please please
submit them the to clamav team. (theres a virus submit link on the main
web page).

They need more info on what's getting missed so they can fix the problem.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Chris Stone wrote:
> On Thursday 05 May 2005 01:54 am, Julian Field wrote:
>
>>On 4 May 2005, at 22:16, Chris Stone wrote:
>>
>>>On Wednesday 04 May 2005 02:57 pm, Julian Field wrote:
>>>
>>>>Julian Field wrote:
>>>>I just tried it with 2 Worm.Sober.P messages from my own servers, and
>>>>neither of them caused any problem whatsoever. Both caught just fine.
>>>>Worked with Maximum Archive Depth = 0 and with = 2.
>>>
>>>This problem is with MS 4.34.8 and ClamAV 0.83, ClamAV Module
>>>(latest from
>>>CPAN). Max Archive Depth = 0.
>>
>>Chris, can you try with the latest MailScanner please. I still cannot
>>find anything unusual whatsoever. You are running with
>>
>>Max Archive Depth = 0
>>Virus Scanners = clamavmodule
>>ClamAV 0.83
>>
>>(That's for my reference as people are not being clear as to whether
>>they are using "clamav" or "clamavmodule".
>
>
> Upgraded to 4.41.3 last night and upgraded ClamAV to 0.84. ClamAVModule is
> 0.17. Didn't seem to make a difference. Other viruses are stopped, but Sober
> is detected and queued for delivery.
>
> As I noted in another email, I can get you root access to the server to test
> and poke around if you still need to. Email me offlist and I'll get you the
> particulars.
>
>
> Chris
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!