Hi all,
I've been noticing for quite a while that *some* of the virus warnings
produced by our amavisd-new installations do not contain a virus name
("Subject: VIRUS () in mail FROM..."). Yesterday, I've actually gotten
around to having a closer look at this, and it seems like this only
happens with findings from the third-party MSRBL-Images/* pattern files.
From the logfiles of one server:
-------------------------<SNIP>-------------------------
# grep Virus /var/log/mail.log
[...]
Sep 18 07:19:25 decado amavis[20179]: (20179-05) Virus
Trojan.Agent-49495 matches (?-xism:.*), sender addr ignored
Sep 18 11:05:13 decado amavis[20951]: (20951-16) Virus
Trojan.Agent-49495 matches (?-xism:.*), sender addr ignored
Sep 18 15:03:47 decado amavis[22445]: (22445-01) Virus matches
(?-xism:.*), sender addr ignored
Sep 18 17:13:10 decado amavis[22866]: (22866-17) Virus matches
(?-xism:.*), sender addr ignored
Sep 18 17:34:02 decado amavis[23223]: (23223-02) Virus matches
(?-xism:.*), sender addr ignored
Sep 18 20:05:44 decado amavis[23783]: (23783-13) Virus
Trojan.Fakealert-532 matches (?-xism:.*), sender addr ignored
Sep 18 20:50:47 decado amavis[23782]: (23782-19) Virus
Trojan.Agent-49495 matches (?-xism:.*), sender addr ignored
Sep 18 22:41:27 decado amavis[24449]: (24449-10) Virus
Trojan.Fakealert-532 matches (?-xism:.*), sender addr ignored
Sep 19 01:33:38 decado amavis[24968]: (24968-11) Virus matches
(?-xism:.*), sender addr ignored
Sep 19 06:22:35 decado amavis[25738]: (25738-09) Virus
Trojan.Fakealert-532 matches (?-xism:.*), sender addr ignored
-------------------------<SNIP>-------------------------
versus
-------------------------<SNIP>-------------------------
# grep FOUND /var/log/clamav/clamav.log
[...]
Thu Sep 18 07:19:25 2008 ->
/var/lib/amavis/tmp/amavis-20080918T062923-20179/parts/p004:
Trojan.Agent-49495 FOUND
Thu Sep 18 11:05:13 2008 ->
/var/lib/amavis/tmp/amavis-20080918T100926-20951/parts/p004:
Trojan.Agent-49495 FOUND
Thu Sep 18 15:03:47 2008 ->
/var/lib/amavis/tmp/amavis-20080918T150347-22445/parts/p004:
MSRBL-Images/3-0-whrB.UNOFFICIAL FOUND
[...]
Thu Sep 18 17:13:10 2008 ->
/var/lib/amavis/tmp/amavis-20080918T162638-22866/parts/p004:
MSRBL-Images/3-0-whrB.UNOFFICIAL FOUND
[...]
Thu Sep 18 17:34:02 2008 ->
/var/lib/amavis/tmp/amavis-20080918T173044-23223/parts/p004:
MSRBL-Images/3-0-whrB.UNOFFICIAL FOUND
[...]
Thu Sep 18 20:05:44 2008 ->
/var/lib/amavis/tmp/amavis-20080918T184631-23783/parts/p006:
Trojan.Fakealert-532 FOUND
Thu Sep 18 20:50:47 2008 ->
/var/lib/amavis/tmp/amavis-20080918T184045-23782/parts/p004:
Trojan.Agent-49495 FOUND
Thu Sep 18 22:41:27 2008 ->
/var/lib/amavis/tmp/amavis-20080918T213151-24449/parts/p006:
Trojan.Fakealert-532 FOUND
Fri Sep 19 01:33:38 2008 ->
/var/lib/amavis/tmp/amavis-20080918T234626-24968/parts/p004:
MSRBL-Images/3-0-whrB.UNOFFICIAL FOUND
[...]
Fri Sep 19 06:22:35 2008 ->
/var/lib/amavis/tmp/amavis-20080919T035912-25738/parts/p006:
Trojan.Fakealert-532 FOUND
-------------------------<SNIP>-------------------------
I'm using the default entry in av_scanners for ClamAV:
-------------------------<SNIP>-------------------------
### http://www.clamav.net/
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
-------------------------<SNIP>-------------------------
I'm having the suspicion that somehow this may be related to the virus
name containing a forward slash (/) character. The regex looks okay, so
it might be amavisd somehow losing track of the virus name internally...
Has anyone seen something similar on their systems and might have a hint
on what could be the cause of this?
For the record, this system is running a more or less current
Debian/testing, amavisd-new-2.6.1 (20080629), LANG="en_US.UTF-8", Perl
version is 5.010000.
Module versions:
Amavis::Conf 2.103
Archive::Zip 1.16
BerkeleyDB 0.34
Compress::Zlib 2.012
Convert::TNEF 0.17
Convert::UUlib 1.11
Crypt::OpenSSL::RSA 0.25
DB_File 1.816_1
Digest::MD5 2.36_01
Digest::SHA 5.47
Digest::SHA1 2.11
MIME::Entity 5.427
MIME::Parser 5.427
MIME::Tools 5.427
Mail::DKIM 0.32
Mail::Header 1.74
Mail::Internet 1.74
Mail::SPF::Query 1.999001
Mail::SpamAssassin 3.002005
Net::DNS 0.63
Net::Server 0.94
Razor2::Client::Version 2.84
Socket6 0.20
Time::HiRes 1.9711
URI 1.35
Unix::Syslog 1.1
Thanks in advance for any assistance!
--
The From: and Reply-To: addresses are internal news2mail gateway addresses.
Reply to the list or to Martin Huber <[EMAIL PROTECTED]>
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
