My recommendation if not done already is to put the Virus log into debug mode, wait until the error occurs, then zip the log and the D file for a message in question and send to Declude support.
John T eServices For You "Seek, and ye shall find!" > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary > Steiner > Sent: Saturday, July 15, 2006 11:29 AM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] Declude error, not ClamAV error > > Yes the command line works fine. Nowhere in the output from the command line does > it say anything about an attachment, nor do I see the "Attachment=[Unknown: Err]" > statement. That's why I believe it is something generated by Declude not by ClamAV. > > > -------- Original Message -------- > > From: "John T \(Lists\)" <[EMAIL PROTECTED]> > > Sent: Saturday, July 15, 2006 2:13 AM > > To: declude.virus@declude.com > > Subject: RE: [Declude.Virus] Declude error, not ClamAV error > > > > Have you tried running the command line by itself against a file in question > > to see what the return code is? > > > > John T > > eServices For You > > > > "Seek, and ye shall find!" > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary > > > Steiner > > > Sent: Friday, July 14, 2006 7:08 PM > > > To: declude.virus@declude.com > > > Subject: RE: [Declude.Virus] Declude error, not ClamAV error > > > > > > I get the error no matter what the virus, Netsky, Bagle, Feebs, even when > > ClamAV > > > detects a fishing attempt the error is there. > > > > > > > > > -------- Original Message -------- > > > > From: "John T \(Lists\)" <[EMAIL PROTECTED]> > > > > Sent: Friday, July 14, 2006 9:46 PM > > > > To: declude.virus@declude.com > > > > Subject: RE: [Declude.Virus] Declude error, not ClamAV error > > > > > > > > In other log lines Declude states it is an invalid/bogus pif file. That > > > > might explain it. > > > > > > > > John T > > > > eServices For You > > > > > > > > "Seek, and ye shall find!" > > > > > > > > > -----Original Message----- > > > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > > Gary > > > > > Steiner > > > > > Sent: Friday, July 14, 2006 2:43 PM > > > > > To: declude.virus@declude.com > > > > > Subject: [Declude.Virus] Declude error, not ClamAV error > > > > > > > > > > Upon further research, the statement "Attachment=[Unknown: Err]" is > > > > generated by > > > > > Declude, not ClamAV. So does Declude have a problem with ClamAV? > > > > > > > > > > > > > > > -------- Original Message -------- > > > > > > From: "Gary Steiner" <[EMAIL PROTECTED]> > > > > > > Sent: Friday, July 14, 2006 1:32 PM > > > > > > To: declude.virus@declude.com > > > > > > Subject: [Declude.Virus] ClamAV error > > > > > > > > > > > > I recently installed ClamAv as my third scanner after AVG and > > F-Prot. > > > > For some > > > > > reason it indicates an error related to the attachment when it detects > > a > > > > virus > > > > > (Attachment=[Unknown: Err]). Here is an example from the Declude > > virus > > > > log file: > > > > > > > > > > > > 07/13/2006 19:32:18.843 366626185 Vulnerability flags = 861 > > > > > > 07/13/2006 19:32:18.843 366626185 MIME file: your_letter.pif > > [base64; > > > > > Length=17424 Checksum=1974090] > > > > > > 07/13/2006 19:32:18.843 366626185 Banning file with pif extension > > > > > [application/octet-stream]. > > > > > > 07/13/2006 19:32:19.328 366626185 AVG Reports VIRUS: I- > Worm/Netsky.D > > > > > > 07/13/2006 19:32:19.328 366626185 File(s) are INFECTED [I- > > > Worm/Netsky.D: > > > > 7] > > > > > > 07/13/2006 19:32:19.625 366626185 Virus scanner 1 reports exit code > > of 3 > > > > > > 07/13/2006 19:32:19.625 366626185 Scanner 1: Virus= > W32/[EMAIL PROTECTED] > > > > > Attachment=your_letter.pif [1] I > > > > > > 07/13/2006 19:32:19.718 366626185 Virus scanner 2 reports exit code > > of 1 > > > > > > 07/13/2006 19:32:19.718 366626185 Warning: file#=366626185 > > > > > (366626185.eml,366626) > > > > > > 07/13/2006 19:32:19.718 366626185 Scanner 2: Virus= > Worm.SomeFool.D > > > > > Attachment=[Unknown: Err] [1] I > > > > > > 07/13/2006 19:32:19.718 366626185 Invalid PIF Vulnerability > > > > > > 07/13/2006 19:32:19.718 366626185 Found a bogus .pif file > > > > > > 07/13/2006 19:32:19.718 366626185 Scanned: CONTAINS A VIRUS > [MIME: 2 > > > > > 17604] > > > > > > 07/13/2006 19:32:19.718 366626185 From: [EMAIL PROTECTED] To: > > > > > [EMAIL PROTECTED] [incoming from 72.82.177.22] > > > > > > 07/13/2006 19:32:19.718 366626185 Subject: Re: Your letter > > > > > > > > > > > > It doesn't seem to matter what kind of virus is involved. Even when > > it > > > > detects a > > > > > phishing attempt you still see the same error. > > > > > > > > > > > > Here is what I have in the virus.cfg: > > > > > > > > > > > > SCANFILE2 C:\SmarterMail\Declude\Scanners\runclamscan.exe log=1 > > > > C:\clamav- > > > > > devel\bin\clamdscan.exe --quiet --mbox --max-ratio 0 --max-space 1M -l > > > > report.txt > > > > > > VIRUSCODE2 1 > > > > > > REPORT2 FOUND > > > > > > > > > > > > Is anyone else experiencing this, or have any ideas? > > > > > > > > > > > > Thanks, > > > > > > > > > > > > Gary > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --- > > > > > > This E-mail came from the Declude.Virus mailing list. To > > > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > > > type "unsubscribe Declude.Virus". The archives can be found > > > > > > at http://www.mail-archive.com. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --- > > > > > This E-mail came from the Declude.Virus mailing list. To > > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > > type "unsubscribe Declude.Virus". The archives can be found > > > > > at http://www.mail-archive.com. > > > > > > > > > > > > > > > > > > > > --- > > > > This E-mail came from the Declude.Virus mailing list. To > > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > > type "unsubscribe Declude.Virus". The archives can be found > > > > at http://www.mail-archive.com. > > > > > > > > > > > > > > > > > > --- > > > This E-mail came from the Declude.Virus mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.Virus". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > > > > --- > > This E-mail came from the Declude.Virus mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.Virus". The archives can be found > > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
