<html>
Something is going wrong in how MailScanner is calling your copy of
F-Prot.<br>
If you do these 2 commands, it should output some sort of summary showing
how many files it scanned, at the very least.<br>
<x-tab> </x-tab>cd
/tmp<br>
<x-tab> </x-tab>/usr/lib/MailScaner/f-prot-wrapper
-old -archive -dumb .<br>
(don't forget the dot on the end)<br><br>
If you get some sort of "command not found" error, then you
have installed your copy of F-Prot somewhere different than the standard
location, and you will need to alter the f-prot-wrapper script so it
calls it in the right place. That script is very simple, you'll soon work
out what you need to change in it.<br><br>
Let us know how you get on.<br><br>
At 23:56 06/11/2002, you wrote:<br>
<blockquote type=cite class=cite cite><font face="courier" size=2>I have
RedHat 7.1, Sendmail8.9.3, MailScanner 4.04-1 and f-prot
3.12b.</font><br>
<br>
<font face="courier" size=2>Everything its seems to be working ok, but if
I send a message from an external account (hotmail) with a virus
attached, I have no warning about an infected message. I tried the
EICAR_test file too, but nothing happened, I just get these lines in
maillog:</font><br>
<br>
<font face="courier" size=2>Nov 6 17:34:11 ns0 sendmail[5914]:
RAA05914:
from=<<a href="mailto:user@hotmail.com">user@hotmail.com</a>>,
size=96715, class=0, pri=126715, nrcpts=1,
msgid=<<a href="mailto:OE17Bt3J3JCj2fBUA510000094e@hotmail.com">OE17Bt3J3JCj2fBUA510000094e@hotmail.com</a>>,
proto=ESMTP, relay=oe17.law7.hotmail.com [216.33.236.121]<br>
Nov 6 17:34:11 ns0 MailScanner[5190]: New Batch: Found 2 messages
waiting <br>
Nov 6 17:34:11 ns0 MailScanner[5190]: New Batch: Scanning 1
messages, 97125 bytes <br>
Nov 6 17:34:12 ns0 MailScanner[5190]: Virus and Content Scanning:
Starting <br>
Nov 6 17:34:12 ns0 MailScanner[5190]: Uninfected: Delivered 1
messages <br>
Nov 6 17:34:12 ns0 sendmail[5919]: RAA05914:
to=<<a href="mailto:mail_user@minar.com">mail_user@minar.com</a>>,
delay=00:00:09, xdelay=00:00:00, mailer=local, stat=Sent<br>
I tested f-prot manually and it says the infection is there (EICAR_test
and an infected file (Magistr). I really apreciate your help to solve
this issue.<br>
</font> <br>
<br>
<font face="courier" size=2>BTW, I got warned about some infected
messages, but they are the ones with IFrame tags in it. </font><br>
<br>
<br>
<font face="courier" size=2>Thanks in advance</font><br>
<br>
<br>
<font face="courier" size=2>(Sorry about my poor English)</font><br>
<br>
<br>
<font face="courier" size=2>vgm</font></blockquote><br>
<div>--</div>
<div>Julian
Field
Teaching Systems Manager</div>
<div>jkf@ecs.soton.ac.uk
Dept. of Electronics & Computer Science</div>
<div>Tel. 023 8059
2817 University of
Southampton</div>
Southampton SO17 1BJ
</html>