[Declude.Virus] ClamAV and Declude problem

2007-07-14 Thread Imail Admin

Hi All,

We've been testing ClamAV with Declude AVA on our new mail server (running 
2006.2).  We only have a few mailboxes on this server because we're still 
testing it.  Today, I ran into a problem where the D: drive ran out of space 
(100GB).  It turns out the d:\temp folder was very large (90GB) and that was 
due to a large number of folders named long string of characters.clamtmp 
or some such.  Each of those folders was full of very files, some quite 
large.  My take is that these are temp folders created by ClamAV, but I 
can't figure out why they're being left behind.


The lines for ClamAV in virus.cfg are:

CLAMAV
SCANFILE2 
D:\Progra~1\clamwin\bin\clamscan.exe --verbose --database=C:\docume~1\alluse~1.win\clamwi~1\db 
--tempdir=D:\Temp --no-summary -l report.txt

VIRUSCODE2 1
REPORT2FOUND

I also noticed some strange lines in the virus log files:

07/13/2007 00:31:17.439 q2a03033d58e6.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:31:17.439 q2a03033d58e6.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:31:17.439 q2a03033d58e6.smd Couldn't delete 
D:\IMail\spool\proc\work\D2a03033d58e6.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]


07/13/2007 00:31:47.440 q2a03033d58e6.smd Scanned: Virus Free [MIME: 1 
26]

07/13/2007 00:32:31.597 q2a8a035958eb.smd Vulnerability flags = 0
07/13/2007 00:33:32.551 q2a8a035958eb.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:33:32.551 q2a8a035958eb.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:33:32.551 q2a8a035958eb.smd Couldn't delete 
D:\IMail\spool\proc\work\D2a8a035958eb.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]


07/13/2007 00:36:57.961 q2b58038758f4.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:36:58.008 q2b58038758f4.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:36:58.008 q2b58038758f4.smd Couldn't delete 
D:\IMail\spool\proc\work\D2b58038758f4.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]
07/13/2007 00:37:03.149 q2b5e036258f7.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:37:03.149 q2b5e036258f7.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:37:03.149 q2b5e036258f7.smd Couldn't delete 
D:\IMail\spool\proc\work\D2b5e036258f7.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]


Any suggestions?  I'm also concerned about the lines where is says the 
process cannot acces the file because it is being used


Thanks,

Ben
BC Web



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



RE: [Declude.Virus] ClamAV and Declude problem

2007-07-14 Thread Jared Pickerell
I had this same problem and had to stop using clam. I believe someone said that 
it was a problem with that version of clam. I don't remember what the fix for 
it was' but would be interested to know as well.

Jared
(from my phone)

-Original Message-
From: Imail Admin [EMAIL PROTECTED]
To: declude.virus@declude.com declude.virus@declude.com
Sent: 7/14/07 3:42 AM
Subject: [Declude.Virus] ClamAV and Declude problem

Hi All,

We've been testing ClamAV with Declude AVA on our new mail server (running 
2006.2).  We only have a few mailboxes on this server because we're still 
testing it.  Today, I ran into a problem where the D: drive ran out of space 
(100GB).  It turns out the d:\temp folder was very large (90GB) and that was 
due to a large number of folders named long string of characters.clamtmp 
or some such.  Each of those folders was full of very files, some quite 
large.  My take is that these are temp folders created by ClamAV, but I 
can't figure out why they're being left behind.

The lines for ClamAV in virus.cfg are:

CLAMAV
SCANFILE2 
 D:\Progra~1\clamwin\bin\clamscan.exe --verbose 
--database=C:\docume~1\alluse~1.win\clamwi~1\db 
 --tempdir=D:\Temp --no-summary -l report.txt
VIRUSCODE2 1
REPORT2FOUND

I also noticed some strange lines in the virus log files:

07/13/2007 00:31:17.439 q2a03033d58e6.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:31:17.439 q2a03033d58e6.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:31:17.439 q2a03033d58e6.smd Couldn't delete 
D:\IMail\spool\proc\work\D2a03033d58e6.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]

07/13/2007 00:31:47.440 q2a03033d58e6.smd Scanned: Virus Free [MIME: 1 
26]
07/13/2007 00:32:31.597 q2a8a035958eb.smd Vulnerability flags = 0
07/13/2007 00:33:32.551 q2a8a035958eb.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:33:32.551 q2a8a035958eb.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:33:32.551 q2a8a035958eb.smd Couldn't delete 
D:\IMail\spool\proc\work\D2a8a035958eb.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]

07/13/2007 00:36:57.961 q2b58038758f4.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:36:58.008 q2b58038758f4.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:36:58.008 q2b58038758f4.smd Couldn't delete 
D:\IMail\spool\proc\work\D2b58038758f4.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]
07/13/2007 00:37:03.149 q2b5e036258f7.smd ERROR: Virus scanner 2 didn't 
finish after 60 seconds; terminating.
07/13/2007 00:37:03.149 q2b5e036258f7.smd Virus scanner 2 reports exit 
code of 0
07/13/2007 00:37:03.149 q2b5e036258f7.smd Couldn't delete 
D:\IMail\spool\proc\work\D2b5e036258f7.vir\report.txt: 32. Error String: 
[The process cannot access the file because it is being used by another 
process.]

Any suggestions?  I'm also concerned about the lines where is says the 
process cannot acces the file because it is being used

Thanks,

Ben
BC Web



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.



---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.