|
hi,
i'm running clamv 0.80 on a suse 8.2 box. i can scan locally files and viruses are noticed.. the problem i have is that an incoming mail with a test virus attached (the clam.exe out of the test dir) is not flagged as a virus.
i tried it with ClamAV plugin for spamassassin or iwth clamassassin directly in procmail:
:0fw: spamassassin.lock
* < 1024000 | spamc -f if i do "cat clam.exe |spamc -f tb" it works fine:
cat /opt/clamav-0.80/test/clam.exe |spamc
X-Spam-Virus: Yes (ClamAV-Test-File) X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on xx.xx.xx.xx X-Spam-Level: ******** X-Spam-Status: Yes, score=8.8 required=5.0 tests=ALL_TRUSTED,CLAMAV, MISSING_DATE,MISSING_SUBJECT autolearn=no version=3.0.2 X-Spam-Report: * 0.0 MISSING_DATE Missing Date: header * -2.8 ALL_TRUSTED Did not pass through any untrusted hosts * 10 CLAMAV Clam AntiVirus detected a virus * 1.6 MISSING_SUBJECT Missing Subject: header if i sent it as an attachment via mail to that machine the header looks like this - by using the clamav plugin - the configuration of spamassassin is stored in an mysql database:
X-Spam-Virus: No
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on xx.xx.xx.xx X-Spam-Level: ** X-Spam-Status: No, score=2.2 required=5.0 tests=AWL,DNS_FROM_RFC_ABUSE, HTML_90_100,HTML_MESSAGE,HTML_SHORT_LENGTH,MIME_HTML_ONLY, SPF_HELO_PASS,SPF_PASS autolearn=no version=3.0.2 --27177789-41-1106064443-2172 Content-Type: TEXT/HTML; CHARSET=us-ascii <HTML><HEAD>
</HEAD>
<BODY style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <DIV>test <SPAN style="WHITE-SPACE: nowrap" type="cite"> --27177789-41-1106064443-2172
Content-Type: APPLICATION/x-msdownload; name="clam.exe" Content-Transfer-Encoding: BASE64 Content-ID: <[EMAIL PROTECTED]> Content-Disposition: attachment; filename="clam.exe" TVpQAAIAAAAEAA8A//8AALgAAAAhAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAEAALtxEEAAM8BQUIvzU1NQsClAMARmrHn5ujEAeA2tUP9mcA4fvjEA6eX/tAnN IbRMzSFiDAoBAnB2FwIeTgwEL9rMEAAAAAAAAAAAAAAAAAAAwBAAAIAQAAAAAAAAAAAAAAAA AADaEAAA9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAS0VSTkVMMzIuRExMAABFeGl0UHJvY2Vz cwBVU0VSMzIuRExMAENMQU1lc3NhZ2VCb3hBAOYQAAAAAAAAPz8/P1BFAABMAQEAYUNhQgAA AAAAAAAA4ACOgQsBAhkABAAAAAYAAAAAAABAEAAAABAAAEAAAAAAAEAAABAAAAACAAABAAAA AAAAAAMACgAAAAAAACAAAAAEAAAAAAAAAgAAAAAAEAAAIAAAAAAQAAAQAAAAAAAAEAAAAAAA AAAAAAAAhBAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAW0NMQU1BVl0AEAAAABAAAAACAAABAAAAAAAAAAAAAAAAAAAA AAAAwA== --27177789-41-1106064443-2172
Content-Type: TEXT/HTML; CHARSET=us-ascii </SPAN> </DIV></BODY></HTML>
any idea what is going wrong?
thanks
torsten |
_______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
