MailScanner --lint doesn't check Eicar virus - OK here!

Michael Mansour micoots at yahoo.com
Thu Nov 29 14:59:59 GMT 2007


Hi Phil,

"Randal, Phil" <prandal at herefordshire.gov.uk> wrote:     Michael,
  
 Which version of RedHat are you  running?
 I'm running Scientific Linux 4.5 (RHEL4 U5), and I see the problem on 6 MailScanner servers, which I'm pretty sure happened after the perl update.

 I see the problem on CentOS 5.0.
  
 It may a side effect of force-installing the perl  update.
 I didn't force install the update, I just removed two RPM's which were clashing with the pre-built MailScanner ones (because the perl errata already had those perl modules in it) and then did the "rpm -Uvh", it went through cleanly.

 It would be nice to know what's actually happening and what  the fix is, though.  I'm not a perl guru so it's beyond  me.
 Yes, I may re-install MS 4.65.3 tomorrow on one of the MailScanner servers and see if it fixes that problem.

Michael. 
 Cheers,
  
 Phil
 --
Phil Randal
Network Engineer
Herefordshire  Council
Hereford, UK 
  

       
---------------------------------
   From:    mailscanner-bounces at lists.mailscanner.info    [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of    Michael Mansour
Sent: 29 November 2007 06:13
To:    MailScanner discussion
Subject: RE: MailScanner --lint doesn't check    Eicar virus - OK here!


   
Hi Quentin,

Quentin Campbell    <Q.G.Campbell at newcastle.ac.uk> wrote:   Phil

It      appears to work here. I get a different result to you:
This is    very strange then. 

This begs the question, in what cases does this    --lint fail with the Eicar virus check?

I'm pretty sure I saw the test    pass with Eicar in there when I upgraded to MailScanner 4.65.3 (not certain    but pretty sure), but only recently noticed that Eicar was no longer there.    This may have happened after some perl errata upgrades on Linux recently    released by Red Hat.

I'm just interested to know now that if this is    the case, then was would cause that symptom and is it causing other problems I    can't see?

Michael.
   [root at cheviot4      MailScanner]# MailScanner --lint
Checking version numbers...
Version      number in MailScanner.conf (4.65.3) is correct.

Your      envelope_sender_header in spam.assassin.prefs.conf is      correct.

Checking for SpamAssassin errors (if you use      it)...
SpamAssassin temp dir =      /var/spool/MailScanner/incoming/SpamAssassin-Temp
SpamAssassin reported      no errors.
MailScanner.conf says "Virus Scanners = clamavmodule      mcafee"
Found these virus scanners installed: clamavmodule,      mcafee
===========================================================================
===========================================================================
Virus      Scanner test reports:
ClamAVModule said "eicar.com was infected:      Eicar-Test-Signature"
McAfee said "/1/eicar.com Found: EICAR test file      NOT a virus."

If any of your virus scanners      (clamavmodule,mcafee)
are not listed there, you should check that they      are installed correctly
and that MailScanner is finding them correctly      via its virus.scanners.conf.
[root at cheviot4 MailScanner]#

Quentin      
---
PHONE: +44 191 222 8209    Information Systems and      Services      (ISS),
                                Newcastle      University,
                                Newcastle upon Tyne,
FAX:   +44 191 222 8765         United Kingdom, NE1      7RU.
------------------------------------------------------------------------





>-----Original      Message-----
>From: mailscanner-bounces at lists.mailscanner.info      [mailto:mailscanner-
>bounces at lists.mailscanner.info] On Behalf Of      Randal, Phil
>Sent: 28 November 2007 14:10
>To: MailScanner      discussion
>Subject: RE: MailScanner --lint doesn't check Eicar      virus
>
>Well spotted!
>
>Confirming that it is      broken in 4.65.3
>
># MailScanner --lint
>Checking version      numbers...
>Version number in MailScanner.conf (4.65.3) is      correct.
>
>Your envelope_sender_header in      spam.assassin.prefs.conf is correct.
>
>Checking for      SpamAssassin errors (if you use it)...
>SpamAssassin temp dir =      /var/spool/MailScanner/incoming/SpamAssassin-
>Temp
>SpamAssassin      reported no errors.
>MailScanner.conf says "Virus Scanners =      clamavmodule mcafee"
>Found these virus scanners installed:      clamavmodule,      mcafee
>========================================================================
>===
>========================================================================
>===
>
>If      any of your virus scanners (clamavmodule,mcafee)
>are not listed      there, you should check that they are installed correctly
>and that      MailScanner is finding them correctly via      its
>virus.scanners.conf.
>
>Cheers,
>
>Phil
>
>--
>Phil      Randal
>Network Engineer
>Herefordshire Council
>Hereford,      UK
>
>
>
>
>
>________________________________
>
>      From:      mailscanner-bounces at lists.mailscanner.info
>[mailto:mailscanner-bounces at lists.mailscanner.info]      On Behalf Of Michael
>Mansour
> Sent: 28 November 2007      14:03
> To: MailScanner discussion
> Subject: MailScanner --lint      doesn't check Eicar virus
>
>
> Hi,
>
> I used      to be able to run:
>
> # MailScanner --lint
> Checking      version numbers...
> Version number in MailScanner.conf (4.65.3) is      correct.
>
> Your envelope_sender_header in      spam.assassin.prefs.conf is
>correct.
>
> Checking for      SpamAssassin errors (if you use it)...
> SpamAssassin temp dir =      /tmp/SpamAssassin-Temp
> SpamAssassin reported no errors.
>      MailScanner.conf says "Virus Scanners = clamavmodule"
> Found these      virus scanners installed: clamavmodule
>      ==================================================================
>=========
>      ==================================================================
>=========
>
>      If any of your virus scanners (clamavmodule)
> are not listed there,      you should check that they are installed
>correctly
> and that      MailScanner is finding them correctly via      its
>virus.scanners.conf.
>
> and see MailScanner test the      Eicar virus between the "===" rows,
>but most recently I see this      doesn't work anymore.
>
> Is there something I can check to see      why?
>
> When I run the wrapper:
>
>      /usr/lib/MailScanner/clamav-wrapper /usr /tmp
>
> it finds      clamav and works scans /tmp fine.
>
> Thanks.
>
>      Michael.
>
>
>
>
>________________________________
>
>      Make the switch to the world's best email. Get the new Yahoo!7
>Mail      now
>
>u.yahoo.com/worldsbestmail/spankey/>      .

--
MailScanner mailing      list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before      posting, read http://wiki.mailscanner.info/posting

Support      MailScanner development - buy the book off the    website!

      

---------------------------------
   Make the switch to the world's best email. Get the new Yahoo!7 Mail now. -- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 


       
---------------------------------
Make the switch to the world's best email. Get the new Yahoo!7 Mail now.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20071130/680e5400/attachment.html


More information about the MailScanner mailing list