<div dir="ltr">> I have the clamavmodule and its working fine<br>
<br>
How do you know this?<br><br><br>I knew because I see in the logs that it is catching stuff<br><br><br><span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">Try sending an email through the machine with the EICAR attachment</span><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
<span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
(</span><a style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);" href="http://www.eicar.org/anti_virus_test_file.htm" target="_blank">http://www.eicar.org/anti_virus_test_file.htm</a><span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">), and check:</span><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
<br>I tried the test , thanks for the link<br><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);"><span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
a) the mail system logs, to see whether MailScanner thinks it's detected a</span><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);"><span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
virus</span><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
<br>In the log , it found it and gave this<br><br>Virus and Content Scanning: Starting<br>ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./A32B56E03A2.E8204/<br>ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./A32B56E03A2.E8204/<a href="http://eicar.com">eicar.com</a><br>
....<br>.....<br>Requeue: A32B56E03A2.E8204 to E19D26E009C<br>....<br>....<br>Cleaned: Delivered 1 cleaned messages<br><br><br><span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">b) the headers of the (presumably) received message, to see whether it tells</span><br style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
<span style="background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
you that anti-virus scanning was performed (X-OrganisationName-</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex; background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
Viruscheck)<br>
<br></blockquote><div>I only had these headers <br>X-MyDomain-MailScanner-ID: AA32E6E03B9.9919A<br>X-MyDomain-MailScanner: Found to be infected<br>X-MyDomain-MailScanner-SpamScore: ss<br>X-MyDomain-MailScanner-From: <a href="mailto:monis.monther@mediaintl.net">monis.monther@mediaintl.net</a><br>
X-Spam-Status: No<br>X-RCPT-TO: <someone><br>Status: U<br>X-UIDL: 548082981<br><br>So I conclude that it was not detected as spam but as infected , and I got the notification attachment delivered saying call help desk... bal bla <br>
<br>But the attachment was not saved under quarantine, I want the attachments to be saved.<br><br> </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex; background-color: rgb(255, 255, 255); color: rgb(0, 0, 153);">
c) the output of /path/to/MailScanner --lint (to see whether it thinks the<br>
antivirus engine is correctly installed and available)<br>
</blockquote><br style="background-color: rgb(255, 255, 255);">It showed that I have clamavmodule successfully installed <br><br><br><br>Conclusion: I was mistakes when I thought it was related to spam score,
but now I want the virus attachment to be stored in quarantine not
deleted, Thanks<br>
<br>
<br style="background-color: rgb(255, 255, 255);"><br><br><br><div class="gmail_quote">On Thu, Nov 19, 2009 at 2:26 PM, Antony Stone <span dir="ltr"><<a href="mailto:Antony.Stone@mailscanner.open.source.it">Antony.Stone@mailscanner.open.source.it</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im">On Thursday 19 November 2009, Monis Monther wrote:<br>
<br>
</div><div class="im">> I have the following<br>
><br>
> Virus Scanning = yes<br>
> Virus Scanners = clamavmodule<br>
> Deliver Disinfected Files = no<br>
> Silent Viruses = HTML-IFrame All-Viruses<br>
> Still Deliver Silent Viruses = no<br>
><br>
</div>> I have the clamavmodule and its working fine<br>
<br>
How do you know this?<br>
<div class="im"><br>
> and when I set HighScore spam = store it started to quarantine virus that<br>
> get a high score spam and still delivers viruses that come with low spam<br>
> messages<br>
<br>
</div>Are you saying that the quarantined messages (quarantined because they are<br>
detected as spam) still contain the virus attachments, or have these been<br>
cleaned?<br>
<br>
Try sending an email through the machine with the EICAR attachment<br>
(<a href="http://www.eicar.org/anti_virus_test_file.htm" target="_blank">http://www.eicar.org/anti_virus_test_file.htm</a>), and check:<br>
<br>
a) the mail system logs, to see whether MailScanner thinks it's detected a<br>
virus<br>
<br>
b) the headers of the (presumably) received message, to see whether it tells<br>
you that anti-virus scanning was performed (X-OrganisationName-Viruscheck)<br>
<br>
c) the output of /path/to/MailScanner --lint (to see whether it thinks the<br>
antivirus engine is correctly installed and available)<br>
<br>
<br>
Antony.<br>
<font color="#888888"><br>
--<br>
"Reports that say that something hasn't happened are always interesting to me,<br>
because as we know, there are known knowns; there are things we know we know.<br>
We also know there are known unknowns; that is to say we know there are some<br>
things we do not know. But there are also unknown unknowns - the ones we<br>
don't know we don't know."<br>
<br>
- Donald Rumsfeld, US Secretary of Defence<br>
</font><div><div></div><div class="h5"><br>
Please reply to the list;<br>
please don't CC me.<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</div></div></blockquote></div><br></div>