Viruses being blocked by filename rules, not being picked up by Clamav

[Scott Silva]

Jon Bates spake the following on 12/4/2006 1:44 PM:
> 
> Reni Berber Wrote:
> 
>> Have you tried changing this into "Virus Scanners = clamavmodule". This
> change
>> means something different of what you are using, option clamav uses the
>> lib/clamav-wrapper, clamavmodule uses the perl module (which you may, or
> may not
>> have installed -- `cpan -D Mail::ClamAV` will show if it is installed).
> 
>> Or using the option as you have it, check virus.scanners.conf to see if
> the
>> corresponding line is correct. Also, if you changed the wrapper, see what
> is
>> being executed (clamscan or clamdscan) and what options are used (with
> clamscan
>> the options are passed as parameters, with clamdscan the options are in
>> /etc/clamd.conf). If using clamdscan, see if clamd is running.
>> -- 
>> Reni Berber
> 
>  
>  
> Hmmm.. Well I definitely havent changed the Virus Scanners option. Its
> always been 'clamav'. Clamavmodule isnt even installed, judging by the
> response from the CPAN install (which I cancelled). I could probably change
> it, but this doesn't make sense to me as it was working perfectly before.
> 
> I've also turned on the log for Clamav so I'll see if there is any leads in
> there.
> ______________________
> 
> Virus.scanners.conf lists:
> 
> clamav          /usr/lib/MailScanner/clamav-wrapper     /usr
> clamavmodule    /bin/false                              /tmp
> 
> ______________________
> 
> The /usr/lib/MailScanner/clamav-wrapper file uses clamscan by the looks of
> it. 
> 
> ______________________
> 
> One setting that I found interesting was Keep Spam And MCP Archive Clean =
> yes. Would this have any bearing on my problem? I don't allow user access to
> archived spam so I might try turning this off.
> 
> Any thoughts?
> 
I didn't see any mention of if the same file can be detected as a virus when
clam is run on the command line.
Does it block an eicar test file if sent through the Mailscanner?

-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!