> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Administrator
> Sent: donderdag 17 maart 2005 17:31
> To: '[email protected]'
> Subject: [Clamav-users] Virus not identified in /var/spool/mqueue
>
>
> hi,
> Version of Clamav 0.83/764 with HP-UX 11.11.
>
> when i try to scan a sendmail spool directory /var/spool/mqueue
> that contains mail infected by EICAR test virus and others virus
> Clamscan does not find any attachments and viruses.
Since files in /var/spool/mqueue commonly consist of two separate
parts, a 'q' and a 'd' file, one holding the headers (with extra info),
the other the data, it does not surprise me that you cannot find
viruses in them. I mean, in that shape they are not exactly
in mbox mail format (or concatenated header + body format).
You should scan in /var/mail/ or something. But better, of course,
to scan prior to delivery (scanning in /var/mail/ could create a
race condition, where a pop client reads from the mbox file before
you could scan it).
- Mark
System Administrator Asarian-host.org
---
"If you were supposed to understand it,
we wouldn't call it code." - FedEx
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
