High ClamScan ...

[Glenn Steen]

On 11/06/07, Steve Campbell <campbell at cnpapers.com> wrote:
>
>
> Julian Field wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> >
> >
> > Steve Campbell wrote:
> >
> >> Julian Field wrote:
> >>
> >>> -----BEGIN PGP SIGNED MESSAGE-----
> >>> Hash: SHA1
> >>>
> >>> Use the clamavmodule or clamd scanners instead.
> >>> You can install the clamavmodule as part of my ClamAV+SA
> >>> easy-to-install package available from www.mailscanner.info.
> >>> Or else get the clamd RPM from dag.wieers.com, start it up and tell
> >>> MailScanner to use the clamd scanner.
> >>>
> >>>
> >> I figured I'd give the clamavmodule a try, and see how it faired. I
> >> have always used Julians ClamAV+SA easy-to-install package and up til
> >> now, the clamscan stuff.. It is not clear to me, now, though, how to
> >> tell if I am really using the Perl module or not.
> >>
> >> Are there any hints?
> >>
> > The log entries will have changed. Chuck it a copy of eicar (see
> > www.eicar.org) and you'll see different log entries. Also the speed
> > should give it away.
> >
>
> The speed is definitely different, but getting the files from eicar.org
> to download, and sending them through to one of our servers here is no
> easy task. We have so much stuffing blocking everything, it's near
> impossible to send something like that.

All you need is a telnet client .... See how in the wiki
(http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot:mta:connexion#eicar_test_message)
... from some machine somewhere suitable, of course:).

If the object is only to detect the use of clamavmodule.... The memory
footprint is a dead giveaway:-)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se