Hi, > >As I'm seeing the line "in Sophos SWEEP for NT" I was thinking I did > >something wrong. However, here are both report files (manually run from the > >commandline). Where is Declude getting the sting "in Sophos ....NT" from? > > I'm guessing that it is in your .eml file. :)
That's the funny part, I had looked at it but that's not it either. Here's my postmaster.eml file: ------------------------ SKIPIFVIRUSNAMEHAS W32/Sobig-F SKIPIFVIRUSNAMEHAS W32/[EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Declude Virus caught a virus Declude Virus v%VERSION% caught the %VIRUSNAME% virus in %VIRUSFILE% from %MAILFROM% to: %ALLRECIPS%. Date: %DATE% %TIME% Subject: %SUBJECT% Spool File: %QUEUENAME% Remote IP: %REMOTEIP% Headers: %HEADERS% -------------------------- And just to make sure I had it all right..... I added the words "this file" to the eml file an sent myself the eicar test once more. The e-mail to the postmaster started like this: ---------------------- this file Declude Virus v1.75 caught the : EICAR_Test_File virus in Sophos SWEEP for NT from [EMAIL PROTECTED] to: [EMAIL PROTECTED] Date: 12/22/2003 14:57:23 Subject: Test eicar.com file [eicarzip] Spool File: Df84100200154a8a7.SMD Remote IP: 216.58.174.203 Headers: [.......] ------------------------ As you can see Declude is using the right template. I guess it's time for the debug mode? Met vriendelijke groet, Bonno Bloksma --- [This E-mail scanned for viruses by Declude Virus using f-prot and Sophos] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
