Viruses being blocked by filename rules, not being picked up by ClamAV

[René Berber]

Jon Bates wrote:
[snip]
> Current ClamAV version is 0.88.6.
>  
> Log shows: 
>  
> Dec  1 16:31:43  MailScanner[28665]: New Batch: Found 2 messages waiting
> Dec  1 16:31:43  MailScanner[28665]: New Batch: Scanning 1 messages, 10461
> bytes
> Dec  1 16:31:44  MailScanner[28515]: Virus and Content Scanning: Starting
> 
> ... so I assume this means that it's working?

Yes, it means that MS is going through the virus scan phase.

>  
> Option: Virus Scanners = clamav

Have you tried changing this into "Virus Scanners = clamavmodule".  This change
means something different of what you are using, option clamav uses the
lib/clamav-wrapper, clamavmodule uses the perl module (which you may, or may not
have installed -- `cpan -D Mail::ClamAV` will show if it is installed).

Or using the option as you have it, check virus.scanners.conf to see if the
corresponding line is correct.  Also, if you changed the wrapper, see what is
being executed (clamscan or clamdscan) and what options are used (with clamscan
the options are passed as parameters, with clamdscan the options are in
/etc/clamd.conf).  If using clamdscan, see if clamd is running.
-- 
René Berber