[Clamav-users] clamav 90.1 isn't detecting attachments

[Bit Fuzzy]

I'm hoping somebody can shed some light on what we're seeing.

We've been using ClamAV since version: 85.1 and have had nothing but 
good things to say about it.

That is until we updated to version 90.1

Since the update any and all messages containing infected attachments 
including the provided test files pass through undetected.


Running "clamscan -r -l scan.txt clamav-0.90.1" manually works fine.
The issue seems to be limited to mail scanning

We scan messages through procmail and trashscan


Any ideas?




___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

[Clamav-users] Re: clamav 90.1 isn't detecting attachments

[Gerard Seibert]

On Saturday March 31, 2007 at 12:25:49 (PM) Bit Fuzzy wrote:

> I'm hoping somebody can shed some light on what we're seeing.
> 
> We've been using ClamAV since version: 85.1 and have had nothing but 
> good things to say about it.
> That is until we updated to version 90.1
> 
> Since the update any and all messages containing infected attachments 
> including the provided test files pass through undetected.
> 
> Running "clamscan -r -l scan.txt clamav-0.90.1" manually works fine.
> The issue seems to be limited to mail scanning
> 
> We scan messages through procmail and trashscan

Personally, I hate procmail. Do you have the option of using either
your MTA or some other LDA? Then I would recommend something like
'mailscanner'   with perhaps 'amavised-new'
 to handle virus checking.

As a side-bar, folding the LDA/POP/IMAP functions all into one
application (Dovecot ) reduces system load and
greatly improves performance.

Works just fine on my FreeBSD-6.2 / Postfix / Dovecot / Mailscanner
system.

-- 
Gerard
___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamav 90.1 isn't detecting attachments

[Matthias Häker]

Bit Fuzzy schrieb:

I'm hoping somebody can shed some light on what we're seeing.

We've been using ClamAV since version: 85.1 and have had nothing but 
good things to say about it.

That is until we updated to version 90.1

Since the update any and all messages containing infected attachments 
including the provided test files pass through undetected.


Running "clamscan -r -l scan.txt clamav-0.90.1" manually works fine.
The issue seems to be limited to mail scanning

We scan messages through procmail and trashscan




maybe is something like the Problem with clamassassin in the trashcan 
script


have a look at

http://lists.jameslick.com/pipermail/clamassassin-announce/2007-February/30.html

Matthias

___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamav 90.1 isn't detecting attachments

[Bit Fuzzy]

Matthias Häker wrote:



Bit Fuzzy schrieb:

I'm hoping somebody can shed some light on what we're seeing.

We've been using ClamAV since version: 85.1 and have had nothing but 
good things to say about it.

That is until we updated to version 90.1

Since the update any and all messages containing infected attachments 
including the provided test files pass through undetected.


Running "clamscan -r -l scan.txt clamav-0.90.1" manually works fine.
The issue seems to be limited to mail scanning

We scan messages through procmail and trashscan




maybe is something like the Problem with clamassassin in the trashcan 
script


have a look at

http://lists.jameslick.com/pipermail/clamassassin-announce/2007-February/30.html 



Matthias


Thanks for the suggestion Matthias.

No, Trashscan didn't use the --mbox switch (or atleast my setup doesn't)


Ken

___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamav 90.1 isn't detecting attachments -- partially fixed

[Bit Fuzzy]

Matthias Häker wrote:



Bit Fuzzy schrieb:

I'm hoping somebody can shed some light on what we're seeing.

We've been using ClamAV since version: 85.1 and have had nothing but 
good things to say about it.

That is until we updated to version 90.1

Since the update any and all messages containing infected attachments 
including the provided test files pass through undetected.


Running "clamscan -r -l scan.txt clamav-0.90.1" manually works fine.
The issue seems to be limited to mail scanning

We scan messages through procmail and trashscan




maybe is something like the Problem with clamassassin in the trashcan 
script


have a look at

http://lists.jameslick.com/pipermail/clamassassin-announce/2007-February/30.html 



Matthias


Matthias,

Your suggestion was actually more helpful than I first thought.

For those using trashscan (if any besides me) the following strings will 
need to be modified:


Old: --disable-summary  New: --no-summary
Old: --unarj=[path]New: --arj=[path]
Old: --zoo=[path]   New: --unzoo=[path]

Though MSRBL images are still not being detected

Ken



___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html