ProcessClamAVOutput

[Ed Bruce]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jan-Peter Koopmann wrote:

I posted the same problem awhile ago and no answers forth coming. I had
the same problem when originating the email from Outlook 2003 thru an
Exchange 2003 server. When I originated the email from Mozilla
Thunderbird thru the same Exchange server (which relays it to our
MailScanner box) no problems. When sending from Outlook the file gets
renames from file.zip to file.zip.zip, otherwise no problem. I've
upgraded to clamav-0.85 and I no longer get the error message but the
encrypted zip file still gets renamed.

>Hi Julian,
>
>any idea?
>
>May 12 17:14:28 proxy MailScanner[3222]: [./1DWFFB-00006F-C3/1.zip] ./1DWFFB-00006F-C3/1.zip: Infected: Trojan-Downloader.Win32.Small.aty [AVP]
>May 12 17:14:28 proxy MailScanner[3222]: Virus Scanning: F-Secure found virus Trojan-Downloader.Win32.Small.aty
>May 12 17:14:28 proxy MailScanner[3222]: Scan ended at Thu May 12 17:14:28 2005
>May 12 17:14:28 proxy MailScanner[3222]: 18 files scanned
>May 12 17:14:28 proxy MailScanner[3222]: 1 file infected
>May 12 17:14:28 proxy MailScanner[3222]: Virus Scanning: F-Secure found 1 infections
>May 12 17:14:28 proxy MailScanner[3222]: /var/spool/MailScanner/incoming/3222/./1DWFFB-00006F-C3/1.zip: Input/Output error
>May 12 17:14:28 proxy MailScanner[3222]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/3222/./1DWFFB-00006F-C3/1.zip: Input/Output error". Please contact the authors!
>
>MailScanner-4-41.3
>clamav-0.84
>
>clamscan of the file says:
>
>proxy:/var/spool/MailScanner/quarantine/20050512/1DWFFB-00006F-C3 # clamscan *
>1.zip: Input/Output error
>1.zip: OK
>message: OK
>
>----------- SCAN SUMMARY -----------
>Known viruses: 33876
>Engine version: 0.84
>Scanned directories: 0
>Scanned files: 2
>Infected files: 0
>Data scanned: 0.00 MB
>Time: 0.495 sec (0 m 0 s)
>
>
>
>unzip 1.zip --> password protected zip.
>
>
>Helpless,
>  JP
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>


--
This message has been scanned for viruses and
dangerous content by Secure Resource, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!