András, > If I send in the GTUBE spam test message, the system rejects it as > expected. But with the Eicar test file I get the following email in the > recipient mailbox: > "Your mail IPADDRESS:1928->IPADDRESS:25 contains contaminated file > eicar.com with virus Eicar_test_file,so it is dropped." > > Actually I can change the final_virus_destiny "Reject" option to any other > available option (Pass, Discard, Bounce) exactly the same happens. > > If I check the maillog, I find that amavis reporting that message is > "Passed CLEAN". I am using Clamd for AV scanning. > I am not 100% sure that this is an AMAVIS related problem, maybe Clamd > reports badly the test virus???
My guess is that your EICAR test pattern is corrupted. It must be all in one line, no other lines preceeding or following it. Seems also like some other virus scanner on a recipient's host was too eager and classified something as Eicar_test_file, which it was not. Go to the test-messages subdirectory in amavisd-new distribution, and send the test file as: sendmail -i postmaster <sample-virus-simple.txt which will not corrupt the pattern. Mark ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
