Frederic, > ... does not detect the Email.Faketube message, althought > runing clamdscan on the mail message in a file found it. > > I have found that it comes from the type of the signature in clamav which > says the signature should be found in an email message. As amavis just send > the part of the messages to clamav, clamav does not see this message as an > email and than don't detect it. Changing the signature type make clamav > work. > > I'm not sure if it's a clamav or amavis issue, but the problem is there. > > I imagine one solution on the amavis side would be to send the original > file to clamav (and the parts too, at the expense of scanning the file > twice). I have not found in the scanner definition on the amavisd.conf file > how to change the name of the file beeing sent (to send the whole file > instead of the parts).
@keep_decoded_original_maps = (new_RE( qr'^MAIL$', # retain full original message for virus checking qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i, )); Mark ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
