Anti-virus woes...

[Glenn Steen]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On 30/11/05, Ken Goods <KGoods at aiainsurance.com> wrote:
> Glenn Steen wrote:
> > On 29/11/05, Ken Goods <KGoods at aiainsurance.com> wrote:
> >> Greetings list...
(snip)
>
> First.. thanks to all who responded and for the excellent suggestions for
> debugging.
>
> Update.. bitdefender is working and caught it's first virus through
> MailScanner at 10:18pm PST last night. I thought I had restarted MS after
> making a change to virus.scanners.conf but maybe not.
> I had mistakenly entered the path all the way to the bdc program instead of
> just the path.. i.e.
>
> bitdefender     /usr/lib/MailScanner/bitdefender-wrapper /opt/bdc/bdc <-
> *here*
>
> Must have got going after MailScanner's normal restart.

Ah, good.

>
> But for ClamAV still no joy.
>
> I'll answer everyone's questions here.
>
> Ugo,
> virus.scanners.conf looks good and ClamAV seems to be updating fine
> according to the output of update_virus_scanners in the log.
> Nov 30 08:09:06 gw-mail update.virus.scanners: Found bitdefender installed
> Nov 30 08:09:06 gw-mail update.virus.scanners: Running autoupdate for
> bitdefender
> Nov 30 08:09:33 gw-mail BitDefender-autoupdate[14702]: BitDefender starting
> update
> Nov 30 08:09:37 gw-mail BitDefender-autoupdate[14702]: BitDefender updated
> Nov 30 08:10:24 gw-mail update.virus.scanners: Found clamav installed
> Nov 30 08:10:24 gw-mail update.virus.scanners: Running autoupdate for clamav
> Nov 30 08:10:25 gw-mail ClamAV-autoupdate[14719]: ClamAV did not need
> updating
>

Yes, but which one is it updating?

> Glenn,
> [root at gw-mail root]# which clamscan
> /usr/local/bin/clamscan
> Could this be a problem? I installed ClamAV & SA using Julian's script
> thinking that this would take care of the path problems that I have ran into
> before. I'm running RH9.0 if it matters...

Just to be "specific", this is what you've reported having in the
virus.scanners.conf:
clamav          /usr/lib/MailScanner/clamav-wrapper     /usr

And as you've shown above, the wrapper can use this to find a
(probably RPM-installed) clamav (actually clamscan) in /usr/bin ...
However, the above shows that /usr/local/bin comes before /usr/bin in
your PATH, and there you have another install of clamav... Which is
used when invoking clamscan from the command line.

If you are to use the same clamscan as from the command line, you need
change that to
clamav          /usr/lib/MailScanner/clamav-wrapper     /usr/local

.... I would recommend that you also remove every last trace of any
clamav RPM install and, after doing that, reinstall Jules package (in
case the rpm -e has ... made something crucial ... go away:).

Which signature files are used is the next thing to look at... I don't
remember if the RPM versions of clamav floating around are split into
one program package and one "database" package, or if it's a
monolithic thing (I've been building this from source a long time
now... Can't really wait for someone to package it for me... Well,
perhaps excepting Jules;). If it is a separate package, remove that
one too.... Probably should do that at the same time the program goes.

>
> [root at gw-mail root]# /opt/bdc/bdc --log=/tmp/testbdc --all
> /var/spool/MailScanner/quarantine/20051129/jATKRZ2n029044/File-packed_dataIn
> fo.exe
> BDC/Linux-Console v7.1 (build 2559) (i386) (Jul  6 2005 16:28:53)
> Copyright (C) 1996-2004 SOFTWIN SRL. All rights reserved.
> Warning: unknown parameter: --all
(snip)
> Works fine but seems like it doesn't like the --all parameter for some
> reason... I had tried that yesterday.

Quirky... Oh well, probably nothing to worry about (I've checked, and
mine accept both "--all" and "-all", without the citation marks (of
course)).

(snip)
> But like I said, bitdefender seems to be working through MailScanner this
> morning. So all is hopefully well with bdc...
>
> Kevin,
> [root at gw-mail root]# clamscan --debug 2>&1 | head -n 1
> LibClamAV debug: Loading databases from /var/clamav
>
> and an ls -l gives:
> [root at gw-mail log]# cd /var/clamav
> [root at gw-mail clamav]# ls -l
> total 8200
> -rw-r--r--    1 clamav   clamav     175561 Nov 29 02:15 daily.cvd
> -rw-r--r--    1 clamav   clamav     177776 Nov  9  2004 daily.cvd.old
> -rw-r--r--    1 clamav   clamav     154914 May 16  2005 daily.cvd.rpmnew
> -rw-r--r--    1 clamav   clamav     198913 Apr 10  2005 daily.cvd.rpmsave
> -rw-r--r--    1 clamav   clamav    2560365 Sep 10 07:08 main.cvd
> -rw-r--r--    1 clamav   clamav    1284637 Sep 16  2004 main.cvd.old
> -rw-r--r--    1 clamav   clamav    2014018 May 16  2005 main.cvd.rpmnew
> -rw-r--r--    1 clamav   clamav    1784802 Mar  7  2005 main.cvd.rpmsave
> [root at gw-mail clamav]#
>
> I assume this is ok. Where are the paths to the databases and clamscan
> configured for MailScanner? I should probably double check that they are
> correct.
>
> Thanks all,
> Ken
(snip)
I wouldn't be so sure that it's OK. What does
/usr/bin/clamscan --version
and
/usr/local/bin/clamscan --version
give? I'm pretty sure it'll show a less than optimal combination in
the first instance... Which is why you probably should take my advice
above and go for "only one clamav on this system";-).

Cheers
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!