Mailscanner / Sophos does not block viruses

[Mark Sapiro]

On 11/14/2013 01:08 AM, ci at holmco.de wrote:
> 
> I hope its o.k. that just clamav scans the mail? Is it correct that,
> as clamav did remove the attachment, sophos does not see the
> infection?


Based on what you've previously posted, MailScanner invoked sophos and
sophos saw the infection. We know this because sophos emailed the admin
about the infection.

The problem is MailScanner is not getting or recognizing the report from
sophos.


> What can I do to get Mailscanner working with sophos?


MailScanner looks for various specific patterns on the output from
sophos. See sub ProcessSophosOutput at about line 1764 in
/usr/lib/MailScanner/MailScanner/SweepViruses.pm


What version of sophos do you have?
What output do you get if you manually run sophos on an infected file?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan