Re: [Clamav-users] Re: Worm.Sober.U not being recognized

[The Disc Shop]

The Disc Shop wrote:



[EMAIL PROTECTED] wrote:

The Disc Shop wrote:
 

[EMAIL PROTECTED] wrote:
clamdscan --config-file=/usr/local/etc/clamd.conf abc
/var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR
  


What are the permissions on /var/spool/virtual/thediscshop.com.au/abc 
?  clamd user needs read access to it.

 

srwxrwxrwx    1 clamav   clamav          0 Dec  2 11:01 clamd
-rw-r-----    1 root     root          707 Dec  2 11:01 clamd.log
-rw-rw----    1 clamav   clamav          5 Dec  2 11:01 clamd.pid
  


On my system the log file is owned by the clamd user.  Don't know why 
yours isn't.  Are you running logrotate against the log file?  If so 
you'll need to tell logrotate to chown the log file to clamav.

 

okay i've managed to get clamdscan to work now, looks like it was the 
clamd.log permissions. Well atleast regarding that Access denied: Error 
above.

Before, when the access denied was still occuring i could not send or 
receive any email. Which is good for not getting viruses but is in now 
way a solution for obvious reasons.

I am now able to send and receive emails with the clamd running linked 
into exim.conf, but it looks like it's not preventing viruses from 
coming through still.

I've added the following to exim.conf

av_scanner = clamd:/var/run/clamav/clamd
# primary_hostname =

.
.
.

check_message:
deny message = This message contains malformed MIME ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
deny message = This message contains a virus or other harmful content 
($malware_name)
demime = *
malware = *
deny message = This message contains an attachment of a type which we do 
not accept (.$found_extension)
demime = bat:com:pif:prf:scr:vbs
warn message = X-Antivirus-Scanner: Clean mail though you should still 
use an Antivirus
 accept

-----

Not sure what else I'm meant to include


_______________________________________________
http://lurker.clamav.net/list/clamav-users.html