<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Rich, thanks for the reply.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I’ve gone through and checked the versions of all the perl-tars
against what’s installed (and reinstalled some of them to make sure the
versions match). Everything that I’ve checked matches the expected versions for
this release of MailScanner.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Sunny<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";
color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:
"Tahoma","sans-serif";color:windowtext'>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Richard
Lynch<br>
<b>Sent:</b> Tuesday, January 12, 2010 11:35 AM<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: MailScanner 4.78.17 doesn't detect viruses, have checked
tmp permissions and no symlink, reinstalled clamav (worked in 4.77.10)<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Sunny Forro wrote: <o:p></o:p></p>
<pre><o:p> </o:p></pre><pre>-----Original Message-----<o:p></o:p></pre><pre>From: <a
href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a><o:p></o:p></pre><pre>[<a
href="mailto:mailscanner-bounces@lists.mailscanner.info">mailto:mailscanner-bounces@lists.mailscanner.info</a>] On Behalf Of Julian<o:p></o:p></pre><pre>Field<o:p></o:p></pre><pre>Sent: Tuesday, January 12, 2010 11:02 AM<o:p></o:p></pre><pre>To: MailScanner discussion<o:p></o:p></pre><pre>Subject: Re: MailScanner 4.78.17 doesn't detect viruses, have checked<o:p></o:p></pre><pre>tmp permissions and no symlink, reinstalled clamav (worked in 4.77.10)<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Check your virus.scanners.conf file to ensure it is pointing at the <o:p></o:p></pre><pre>correct place for clamav.<o:p></o:p></pre><pre>If "which clamscan" reports /usr/local/bin/clamscan then the clamav line<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>in virus.scanners.conf should end in "/usr/local" and if it reports <o:p></o:p></pre><pre>/usr/bin/clamscan then the line should end in "/usr".<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>That would be the first place to look. Then "MailScanner --lint" should <o:p></o:p></pre><pre>detect the EICAR test pattern successfully. Once "MailScanner --lint" <o:p></o:p></pre><pre>works, you're there.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Jules.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>------ Outlook sucks -----------<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Jules, thanks for the reply!<o:p></o:p></pre><pre>I checked "which clamscan" and yes it does point to<o:p></o:p></pre><pre>/usr/local/bin/clamscan. The clamav line in virus.scanners.conf does end<o:p></o:p></pre><pre>in /usr/local. Still no lint under 4.78.17, but works fine under<o:p></o:p></pre><pre>pervious versions on the same box. Using clamav-wrapper to do a scan of<o:p></o:p></pre><pre>/tmp gives me sensible output however.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Sunny<o:p></o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre><o:p> </o:p></pre><pre>On 12/01/2010 15:45, Sunny Forro wrote:<o:p></o:p></pre><pre> <o:p></o:p></pre>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><pre>Hello,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I've just upgraded to 4.78.17 and now mailscanner doesn't report <o:p></o:p></pre><pre>viruses detected by clamav in production or lint. I've scanned the <o:p></o:p></pre><pre>/tmp directory with clamav-wrapper and get sensible clam output. /tmp <o:p></o:p></pre><pre>is not symlinked. I've reinstalled clamav, and manually reinstalled <o:p></o:p></pre><pre>all the per-tars from the install directory. I've even tried <o:p></o:p></pre><pre>downgrading MIME-tools to 5.420 (as found on another post), but to no <o:p></o:p></pre><pre>effect (and since reinstalled from perl-tar to 5.427). I've removed <o:p></o:p></pre><pre>and reinstalled Perl5.8.9, also to no effect. I'm running MS4.78.17, <o:p></o:p></pre><pre>SA3.2.5, Clam0.95.3, sendmail 8.14.3 on FreeBSD7.0p9, w/ mailwatch <o:p></o:p></pre><pre>1.0.4, apache13, mysql5077, php5, virtualized through VMWare VSphere <o:p></o:p></pre><pre>4.0. I've switched back to 4.77.10 as this properly identifies virii. <o:p></o:p></pre><pre>I'm out of ideas - Any suggestions? Is there something else I need to <o:p></o:p></pre><pre>check, or something else I missed?<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Any help would be greatly appreciated.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Sunny Forro<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>P.S. Thanks a million to Julian Field for a fantastic solution to the <o:p></o:p></pre><pre>deluge of spam we had grown accustomed to.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> <o:p></o:p></pre></blockquote>
<pre><o:p> </o:p></pre><pre>Jules<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> <o:p></o:p></pre>
<p class=MsoNormal>This may be totally unrelated but I had a similar problem
like this at one point. It turned out that the perl I was running had
version 0.16 of perl-File-Temp builtin and the version that came packaged with
MailScanner was 0.19. When perl was updated v0.19 was removed. I
ended up having to do a rpm --force on the version that came packaged with
MailScanner.<br>
<br>
This is all from vague memories and I may not have the scenario exactly right.
It took me a while to find it though. Check the version of File::Temp
that you are using. I know that once I got the correct version installed
MailScanner --lint started producing expected results with my virus scanners.<br>
<br>
Rich<br>
<br>
<br>
<o:p></o:p></p>
<pre>-- <o:p></o:p></pre><pre><o:p> </o:p></pre><pre>"Of all tyrannies, a tyranny exercised for the good of its victims may<o:p></o:p></pre><pre>be the most oppressive. It may be better to live under robber barons<o:p></o:p></pre><pre>than omnipotent moral busybodies. The robber baron's cruelty may<o:p></o:p></pre><pre>sometimes sleep, his cupidity may at some point be satiated; but those<o:p></o:p></pre><pre>who torment us for our own good will torment us without end, for they do<o:p></o:p></pre><pre>so with the approval of their own conscience."<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> -- C.S. Lewis<span
style='color:#1F497D'><o:p></o:p></span></pre><pre><span style='font-size:11.0pt;
font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></pre></div>
</div>
</body>
</html>