Hi Phil,<br><br><b><i>"Randal, Phil" <prandal@herefordshire.gov.uk></i></b> wrote:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta content="MSHTML 6.00.2900.3199" name="GENERATOR"> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">Michael,</font></span></div> <div dir="ltr" align="left"><span class="400055613-29112007"></span> </div> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">Which version of RedHat are you running?</font></span></div> </blockquote><div dir="ltr" align="left"><span class="400055613-29112007"></span>I'm running Scientific Linux 4.5 (RHEL4 U5), and I see the problem on 6 MailScanner servers, which I'm pretty sure happened after the perl update.<br></div><blockquote class="replbq"
style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">I see the problem on CentOS 5.0.</font></span></div> <div dir="ltr" align="left"><span class="400055613-29112007"></span> </div> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">It may a side effect of force-installing the perl update.</font></span></div> </blockquote><div dir="ltr" align="left"><span class="400055613-29112007"></span>I didn't force install the update, I just removed two RPM's which were clashing with the pre-built MailScanner ones (because the perl errata already had those perl modules in it) and then did the "rpm -Uvh", it went through cleanly.<br></div><blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> <div dir="ltr" align="left"><span
class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">It would be nice to know what's actually happening and what the fix is, though. I'm not a perl guru so it's beyond me.</font></span></div> </blockquote><div dir="ltr" align="left">Yes, I may re-install MS 4.65.3 tomorrow on one of the MailScanner servers and see if it fixes that problem.<br><br><span class="400055613-29112007"></span>Michael. </div><blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">Cheers,</font></span></div> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2"></font></span> </div> <div dir="ltr" align="left"><span class="400055613-29112007"><font color="#0000ff" face="Arial" size="2">Phil</font></span></div> <div dir="ltr" align="left"><span
class="400055613-29112007"></span><font size="2">--<br>Phil Randal<br>Network Engineer<br>Herefordshire Council<br>Hereford, UK </font></div> <div> </div><br> <blockquote style="border-left: 2px solid rgb(0, 0, 255); padding-left: 5px; margin-left: 5px; margin-right: 0px;"> <div class="OutlookMessageHeader" dir="ltr" align="left" lang="en-us"> <hr tabindex="-1"> <font face="Tahoma" size="2"><b>From:</b> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Michael Mansour<br><b>Sent:</b> 29 November 2007 06:13<br><b>To:</b> MailScanner discussion<br><b>Subject:</b> RE: MailScanner --lint doesn't check Eicar virus - OK here!<br></font><br></div> <div></div>Hi Quentin,<br><br><b><i>Quentin Campbell <Q.G.Campbell@newcastle.ac.uk></i></b> wrote: <blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); padding-left: 5px; margin-left: 5px;">Phil<br><br>It
appears to work here. I get a different result to you:<br></blockquote>This is very strange then. <br><br>This begs the question, in what cases does this --lint fail with the Eicar virus check?<br><br>I'm pretty sure I saw the test pass with Eicar in there when I upgraded to MailScanner 4.65.3 (not certain but pretty sure), but only recently noticed that Eicar was no longer there. This may have happened after some perl errata upgrades on Linux recently released by Red Hat.<br><br>I'm just interested to know now that if this is the case, then was would cause that symptom and is it causing other problems I can't see?<br><br>Michael.<br> <blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); padding-left: 5px; margin-left: 5px;">[root@cheviot4 MailScanner]# MailScanner --lint<br>Checking version numbers...<br>Version number in MailScanner.conf (4.65.3) is correct.<br><br>Your envelope_sender_header in
spam.assassin.prefs.conf is correct.<br><br>Checking for SpamAssassin errors (if you use it)...<br>SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp<br>SpamAssassin reported no errors.<br>MailScanner.conf says "Virus Scanners = clamavmodule mcafee"<br>Found these virus scanners installed: clamavmodule, mcafee<br>===========================================================================<br>===========================================================================<br>Virus Scanner test reports:<br>ClamAVModule said "eicar.com was infected: Eicar-Test-Signature"<br>McAfee said "/1/eicar.com Found: EICAR test file NOT a virus."<br><br>If any of your virus scanners (clamavmodule,mcafee)<br>are not listed there, you should check that they are installed correctly<br>and that MailScanner is finding them correctly via its virus.scanners.conf.<br>[root@cheviot4 MailScanner]#<br><br>Quentin
<br>---<br>PHONE: +44 191 222 8209 Information Systems and Services (ISS),<br> Newcastle University,<br> Newcastle upon Tyne,<br>FAX: +44 191 222 8765 United Kingdom, NE1 7RU.<br>------------------------------------------------------------------------<br><br><br><br><br><br>>-----Original Message-----<br>>From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-<br>>bounces@lists.mailscanner.info] On Behalf Of Randal, Phil<br>>Sent: 28 November 2007 14:10<br>>To: MailScanner discussion<br>>Subject: RE: MailScanner --lint doesn't check
Eicar virus<br>><br>>Well spotted!<br>><br>>Confirming that it is broken in 4.65.3<br>><br>># MailScanner --lint<br>>Checking version numbers...<br>>Version number in MailScanner.conf (4.65.3) is correct.<br>><br>>Your envelope_sender_header in spam.assassin.prefs.conf is correct.<br>><br>>Checking for SpamAssassin errors (if you use it)...<br>>SpamAssassin temp dir = /var/spool/MailScanner/incoming/SpamAssassin-<br>>Temp<br>>SpamAssassin reported no errors.<br>>MailScanner.conf says "Virus Scanners = clamavmodule mcafee"<br>>Found these virus scanners installed: clamavmodule, mcafee<br>>========================================================================<br>>===<br>>========================================================================<br>>===<br>><br>>If any of your virus scanners (clamavmodule,mcafee)<br>>are not listed there,
you should check that they are installed correctly<br>>and that MailScanner is finding them correctly via its<br>>virus.scanners.conf.<br>><br>>Cheers,<br>><br>>Phil<br>><br>>--<br>>Phil Randal<br>>Network Engineer<br>>Herefordshire Council<br>>Hereford, UK<br>><br>><br>><br>><br>><br>>________________________________<br>><br>> From: mailscanner-bounces@lists.mailscanner.info<br>>[mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Michael<br>>Mansour<br>> Sent: 28 November 2007 14:03<br>> To: MailScanner discussion<br>> Subject: MailScanner --lint doesn't check Eicar virus<br>><br>><br>> Hi,<br>><br>> I used to be able to run:<br>><br>> # MailScanner --lint<br>> Checking version numbers...<br>> Version number in MailScanner.conf (4.65.3) is correct.<br>><br>> Your envelope_sender_header in
spam.assassin.prefs.conf is<br>>correct.<br>><br>> Checking for SpamAssassin errors (if you use it)...<br>> SpamAssassin temp dir = /tmp/SpamAssassin-Temp<br>> SpamAssassin reported no errors.<br>> MailScanner.conf says "Virus Scanners = clamavmodule"<br>> Found these virus scanners installed: clamavmodule<br>> ==================================================================<br>>=========<br>> ==================================================================<br>>=========<br>><br>> If any of your virus scanners (clamavmodule)<br>> are not listed there, you should check that they are installed<br>>correctly<br>> and that MailScanner is finding them correctly via its<br>>virus.scanners.conf.<br>><br>> and see MailScanner test the Eicar virus between the "===" rows,<br>>but most recently I see this doesn't work anymore.<br>><br>> Is there something
I can check to see why?<br>><br>> When I run the wrapper:<br>><br>> /usr/lib/MailScanner/clamav-wrapper /usr /tmp<br>><br>> it finds clamav and works scans /tmp fine.<br>><br>> Thanks.<br>><br>> Michael.<br>><br>><br>><br>><br>>________________________________<br>><br>> Make the switch to the world's best email. Get the new Yahoo!7<br>>Mail now<br>><HTTP: a="" *http:="" spankey="" mail="" default_all="" taglines="" au.rd.yahoo.com=""><br>>u.yahoo.com/worldsbestmail/spankey/> .<br><br>--<br>MailScanner mailing list<br>mailscanner@lists.mailscanner.info<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner<br><br>Before posting, read http://wiki.mailscanner.info/posting<br><br>Support MailScanner development - buy the book off the website!<br></HTTP:></blockquote><br> <div> </div><hr size="1"> Make the switch to the world's best email. <a
href="http://au.rd.yahoo.com/mail/taglines/default_all/mail/spankey/*http://au.yahoo.com/worldsbestmail/spankey/" target="_blank">Get the new Yahoo!7 Mail now</a>. </blockquote>-- <br>MailScanner mailing list<br>mailscanner@lists.mailscanner.info<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner<br><br>Before posting, read http://wiki.mailscanner.info/posting<br><br>Support MailScanner development - buy the book off the website! <br></blockquote><br><p> 
<hr size=1>
Make the switch to the world's best email. <a href="http://au.rd.yahoo.com/mail/taglines/default_all/mail/spankey/*http://au.yahoo.com/worldsbestmail/spankey/" target=_blank>Get the new Yahoo!7 Mail now</a>.