Sophos & ClamAV + Sanesecurity

[Mike Wallace]

I am seeing a similar problem except I don't run Sophos or sanesecurity signatures. I don't know when this started as in a previously version of MailScanner and ClamAv (don't know which ones) this didn't happen.

What I occasionally see is that clamav 0.95.3 finds an infection but the message never gets spam checked. Logs shows that once the infection is found, the message gets re-queued and delivered. It looks like it never gets spam checked.

I my configuration I need to strip all viruses and "Mark Infected Messages".

Anyone have any ideas? 

Mike Wallace
mike at mlrw.com



On Dec 23, 2009, at 3:48 AM, ThB wrote:

> 
> I'm running MailScanner and SA, ClamAV + sanesecurity signatures but also Sophos SAVI as a comercial virus scanner. Lately I reconfigured MS to recognize sanesecurity hits as spam. In my configuration viruses should be replaced by a warning message but still be delivered, so the users know they got a message.
> 
>> From time to time there are messages which seem to be detected by Sophos as virus and by ClamAV as spam because of sanesecurity signatures. Such messages have the SpamVirus header but an empty SpamCheck header and no SpamScore. Such messages also are tagged as "Found to be infected" but the body part is not replaced.
> 
> X-MailScanner: Found to be infected
> X-MailScanner-SpamVirus-Report: Sanesecurity.Junk.19516.UNOFFICIAL
> X-MailScanner-SpamCheck:
> 
> This now is neither the correct "virus" nor "spam" behaviour as configured.
> My request: do either the correct virus processing or the correct spam processing.
> 
> 
> MailScanner 4.79.4
> SpamAssassin 3.2.5
> ClamAV 0.95.3
> Sophos 4.48.0
> 
> thanks and merry xmas
> Thomas
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 
> 
> This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
>