Martin,
> I've been noticing for quite a while that *some* of the virus warnings
> produced by our amavisd-new installations do not contain a virus name
> ("Subject: VIRUS () in mail FROM..."). Yesterday, I've actually gotten
> around to having a closer look at this, and it seems like this only
> happens with findings from the third-party MSRBL-Images/* pattern files.
> Sep 18 11:05:13 decado amavis[20951]: (20951-16) Virus
> Trojan.Agent-49495 matches (?-xism:.*), sender addr ignored
> Sep 18 15:03:47 decado amavis[22445]: (22445-01) Virus
> matches (?-xism:.*), sender addr ignored
> /var/lib/amavis/tmp/amavis-20080918T100926-20951/parts/p004:
> Trojan.Agent-49495 FOUND
> /var/lib/amavis/tmp/amavis-20080918T150347-22445/parts/p004:
> MSRBL-Images/3-0-whrB.UNOFFICIAL FOUND
> I'm using the default entry in av_scanners for ClamAV:
> ['ClamAV-clamd',
> \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
> qr/\bOK$/, qr/\bFOUND$/,
> qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
>
> I'm having the suspicion that somehow this may be related to the virus
> name containing a forward slash (/) character. The regex looks okay, so
> it might be amavisd somehow losing track of the virus name internally...
>
> For the record, this system is running a more or less current
> Debian/testing, amavisd-new-2.6.1 (20080629), LANG="en_US.UTF-8",
> Perl version is 5.010000.
That was a tough one. It turns out there is a bug (or an undocumented change)
in perl5.10.0:
$ perl5.8.8 -le '$r=qr/(.)$/; @a= "abC\ndeF\n" =~ /$r/mg; print join(",",@a)'
C,F
$ perl5.10.0 -le '$r=qr/(.)$/; @a= "abC\ndeF\n" =~ /$r/mg; print join(",",@a)'
F
A workaround it to use the /m flag also in the qr of a virus entry,
as the /m in the final evaluating expression seems to be ignored:
$ perl5.10.0 -le '$r=qr/(.)$/m; @a= "abC\ndeF\n" =~ /$r/mg; print join(",",@a)'
C,F
Note the final /m in the last regexp, which is needed for perl 5.10.0
(and does not hurt the 5.8.8) :
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
Thanks for reporting the problem.
Mark
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
