I also use Terry's runclamscan with no issues.
I have had rare email melt downs when I was running runclamd. I could never
pin it firmly on anything. So I stopped the runclamd to see how it handles.
----- Original Message -----
From: "David Sullivan" <[EMAIL PROTECTED]>
To: <Declude.Virus@declude.com>
Sent: Saturday, June 04, 2005 1:18 PM
Subject: Re[2]: [Declude.Virus] Second Scanner
Hello Scott,
Friday, June 3, 2005, 10:48:47 PM, you wrote:
SF> One last ClamAV comment...
SF> I've added the command line switch --max-ratio 0
SF> I've had some false positives on some .zip files that forced me to add
the
SF> switch.
Thanks for the info. I've been running clam now with Terry's
runclamscan since last night on 2 machines. At one point on each
machine started getting these errors in the Declude Virus file:
06/04/2005 14:06:54 Qed8200000cb43917 ERROR: Virus scanner 2 didn't finish
after 60 seconds; terminating.
06/04/2005 14:06:54 Qed8200000cb43917 WARNING: Couldn't remove .vir
directory o:\spool\Ded8200000cb43917.vir\: SHARING VIOLATION.
06/04/2005 14:06:54 Qed8200000cb43917 Likely problem: An on-access scanner
is interfering; disable or set not to scan subdirectories off of
\IMail\spool.
Then, they balloon to ones like this:
06/04/2005 14:07:25 Qed87026a0076c30a ERROR: Could not move virus-infected
E-mail! Code: 32 0 o:\spool\Ded87026a0076c30a.SMD
L:\virustrap\Ded87026a0076c30a.SMD. Re-trying.
06/04/2005 14:07:26 Qed82035200bac2f1 ERROR: Could not move virus-infected
E-mail! Code: 32 0 o:\spool\Ded82035200bac2f1.SMD
L:\virustrap\Ded82035200bac2f1.SMD. Re-trying.
06/04/2005 14:07:26 Qed8402890066c2fa ERROR: Could not move virus-infected
E-mail! Code: 32 0 o:\spool\Ded8402890066c2fa.SMD
L:\virustrap\Ded8402890066c2fa.SMD. Re-trying.
It took a reboot of both machines to fix the problem. On one I had 288
process running which fouls everything else up. Clam is SCANNER2
Any ideas?
--
Best regards,
David mailto:[EMAIL PROTECTED]
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.Virus mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus". The archives can be found
at http://www.mail-archive.com.
