MailScanner --lint doesn't check Eicar virus - OK here!
Michael Mansour
micoots at yahoo.com
Thu Nov 29 14:59:59 GMT 2007
Hi Phil,
"Randal, Phil" <prandal at herefordshire.gov.uk> wrote: Michael,
Which version of RedHat are you running?
I'm running Scientific Linux 4.5 (RHEL4 U5), and I see the problem on 6 MailScanner servers, which I'm pretty sure happened after the perl update.
I see the problem on CentOS 5.0.
It may a side effect of force-installing the perl update.
I didn't force install the update, I just removed two RPM's which were clashing with the pre-built MailScanner ones (because the perl errata already had those perl modules in it) and then did the "rpm -Uvh", it went through cleanly.
It would be nice to know what's actually happening and what the fix is, though. I'm not a perl guru so it's beyond me.
Yes, I may re-install MS 4.65.3 tomorrow on one of the MailScanner servers and see if it fixes that problem.
Michael.
Cheers,
Phil
--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
---------------------------------
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael Mansour
Sent: 29 November 2007 06:13
To: MailScanner discussion
Subject: RE: MailScanner --lint doesn't check Eicar virus - OK here!
Hi Quentin,
Quentin Campbell <Q.G.Campbell at newcastle.ac.uk> wrote: Phil
It appears to work here. I get a different result to you:
This is very strange then.
This begs the question, in what cases does this --lint fail with the Eicar virus check?
I'm pretty sure I saw the test pass with Eicar in there when I upgraded to MailScanner 4.65.3 (not certain but pretty sure), but only recently noticed that Eicar was no longer there. This may have happened after some perl errata upgrades on Linux recently released by Red Hat.
I'm just interested to know now that if this is the case, then was would cause that symptom and is it causing other problems I can't see?
Michael.
[root at cheviot4 MailScanner]# MailScanner --lint
Checking version numbers...
Version number in MailScanner.conf (4.65.3) is correct.
Your envelope_sender_header in spam.assassin.prefs.conf is correct.
Checking for SpamAssassin errors (if you use it)...
SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp
SpamAssassin reported no errors.
MailScanner.conf says "Virus Scanners = clamavmodule mcafee"
Found these virus scanners installed: clamavmodule, mcafee
===========================================================================
===========================================================================
Virus Scanner test reports:
ClamAVModule said "eicar.com was infected: Eicar-Test-Signature"
McAfee said "/1/eicar.com Found: EICAR test file NOT a virus."
If any of your virus scanners (clamavmodule,mcafee)
are not listed there, you should check that they are installed correctly
and that MailScanner is finding them correctly via its virus.scanners.conf.
[root at cheviot4 MailScanner]#
Quentin
---
PHONE: +44 191 222 8209 Information Systems and Services (ISS),
Newcastle University,
Newcastle upon Tyne,
FAX: +44 191 222 8765 United Kingdom, NE1 7RU.
------------------------------------------------------------------------
>-----Original Message-----
>From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
>bounces at lists.mailscanner.info] On Behalf Of Randal, Phil
>Sent: 28 November 2007 14:10
>To: MailScanner discussion
>Subject: RE: MailScanner --lint doesn't check Eicar virus
>
>Well spotted!
>
>Confirming that it is broken in 4.65.3
>
># MailScanner --lint
>Checking version numbers...
>Version number in MailScanner.conf (4.65.3) is correct.
>
>Your envelope_sender_header in spam.assassin.prefs.conf is correct.
>
>Checking for SpamAssassin errors (if you use it)...
>SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-
>Temp
>SpamAssassin reported no errors.
>MailScanner.conf says "Virus Scanners = clamavmodule mcafee"
>Found these virus scanners installed: clamavmodule, mcafee
>========================================================================
>===
>========================================================================
>===
>
>If any of your virus scanners (clamavmodule,mcafee)
>are not listed there, you should check that they are installed correctly
>and that MailScanner is finding them correctly via its
>virus.scanners.conf.
>
>Cheers,
>
>Phil
>
>--
>Phil Randal
>Network Engineer
>Herefordshire Council
>Hereford, UK
>
>
>
>
>
>________________________________
>
> From: mailscanner-bounces at lists.mailscanner.info
>[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Michael
>Mansour
> Sent: 28 November 2007 14:03
> To: MailScanner discussion
> Subject: MailScanner --lint doesn't check Eicar virus
>
>
> Hi,
>
> I used to be able to run:
>
> # MailScanner --lint
> Checking version numbers...
> Version number in MailScanner.conf (4.65.3) is correct.
>
> Your envelope_sender_header in spam.assassin.prefs.conf is
>correct.
>
> Checking for SpamAssassin errors (if you use it)...
> SpamAssassin temp dir = /tmp/SpamAssassin-Temp
> SpamAssassin reported no errors.
> MailScanner.conf says "Virus Scanners = clamavmodule"
> Found these virus scanners installed: clamavmodule
> ==================================================================
>=========
> ==================================================================
>=========
>
> If any of your virus scanners (clamavmodule)
> are not listed there, you should check that they are installed
>correctly
> and that MailScanner is finding them correctly via its
>virus.scanners.conf.
>
> and see MailScanner test the Eicar virus between the "===" rows,
>but most recently I see this doesn't work anymore.
>
> Is there something I can check to see why?
>
> When I run the wrapper:
>
> /usr/lib/MailScanner/clamav-wrapper /usr /tmp
>
> it finds clamav and works scans /tmp fine.
>
> Thanks.
>
> Michael.
>
>
>
>
>________________________________
>
> Make the switch to the world's best email. Get the new Yahoo!7
>Mail now
>
>u.yahoo.com/worldsbestmail/spankey/> .
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
---------------------------------
Make the switch to the world's best email. Get the new Yahoo!7 Mail now. --
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner
Before posting, read http://wiki.mailscanner.info/posting
Support MailScanner development - buy the book off the website!
---------------------------------
Make the switch to the world's best email. Get the new Yahoo!7 Mail now.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20071130/680e5400/attachment.html
More information about the MailScanner
mailing list