Hello Chuck, Thank you very much for provided information.
With best regards, Ivan -----Original Message----- From: Chuck Swiger <[email protected]> To: ClamAV users ML <[email protected]> Sent: Tue, Oct 25, 2011 7:20 pm Subject: Re: [clamav-users] A trojan is not blocked On Oct 25, 2011, at 5:55 AM, Ivan Ivanov wrote: > Configuration amavisd + ClamAV. [ ... ] > I just wondering why original message passed, but NDR (with attached original message) was blocked. amavisd is probably not setup to pass the raw message to clamd for scanning. See whether bypass_decode_parts is on in amavisd.conf, and/or check your keep_decoded_original_maps setting. Sanesecurity has mention of this issue here: http://www.sanesecurity.com/problems.htm Regards, -- -Chuck _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
