Fwd: Store viruses only

[Antony Stone]

On Thursday 19 November 2009, Monis Monther wrote:

> I have the following
>
> Virus Scanning = yes
> Virus Scanners = clamavmodule
> Deliver Disinfected Files = no
> Silent Viruses = HTML-IFrame All-Viruses
> Still Deliver Silent Viruses = no
>
> I have the clamavmodule and its working fine

How do you know this?

> and when I set HighScore spam = store it started to quarantine virus that
> get a high score spam and still delivers viruses that come with low spam
> messages  

Are you saying that the quarantined messages (quarantined because they are 
detected as spam) still contain the virus attachments, or have these been 
cleaned?

Try sending an email through the machine with the EICAR attachment 
(http://www.eicar.org/anti_virus_test_file.htm), and check:

a) the mail system logs, to see whether MailScanner thinks it's detected a 
virus

b) the headers of the (presumably) received message, to see whether it tells 
you that anti-virus scanning was performed (X-OrganisationName-Viruscheck)

c) the output of /path/to/MailScanner --lint (to see whether it thinks the 
antivirus engine is correctly installed and available)


Antony.

-- 
"Reports that say that something hasn't happened are always interesting to me, 
because as we know, there are known knowns; there are things we know we know. 
We also know there are known unknowns; that is to say we know there are some 
things we do not know. But there are also unknown unknowns - the ones we 
don't know we don't know."

 - Donald Rumsfeld, US Secretary of Defence

                                                     Please reply to the list;
                                                           please don't CC me.