I'm starting to lose patience with this . . . . help????
I uninstalled and then installed the latest version of openprotect. So now
my problems are that:
1) freshclam refuses to run: Here's the cron output:
/etc/cron.hourly/check_mailscanner:
Starting MailScanner...
/etc/cron.hourly/freshclam:
/etc/cron.hourly/freshclam: /lib/libc.so.6: version `GLIBC_2.3' not found
(required by /etc/cron.hourly/freshclam)
/etc/cron.hourly/freshclam: /lib/libc.so.6: version `GLIBC_2.3' not found
(required by /usr/lib/libclamav.so.1)
2) Zip files are still passed without warning even though the contents are
found to have a virus. Again, here's the log file:
Apr 29 15:59:31 kingsmere MailScanner[9871]: New Batch: Scanning 1 messages,
31509 bytes
Apr 29 15:59:31 kingsmere MailScanner[9871]: MCP Checks: Starting
Apr 29 15:59:37 kingsmere MailScanner[9871]: Spam Checks: Found 1 spam
messages
Apr 29 15:59:37 kingsmere MailScanner[9871]: Virus and Content Scanning:
Starting
Apr 29 15:59:42 kingsmere MailScanner[9871]:
/usr/share/spool/MailScanner/incoming/9871/./i3TJxSr10783/Details.zip:
Worm.SomeFool.Z FOUND
Apr 29 15:59:42 kingsmere MailScanner[9871]: Virus Scanning: ClamAV found 1
infections
Apr 29 15:59:48 kingsmere MailScanner[9871]:
/usr/share/spool/MailScanner/incoming/9871/i3TJxSr10783/Details.zip/Details.txt
.exe INFECTED I-Worm.NetSky.aa
Apr 29 15:59:48 kingsmere MailScanner[9871]: Virus Scanning: Kaspersky found
1 infections
Apr 29 15:59:48 kingsmere MailScanner[9871]: Virus Scanning: Found 1 viruses
Apr 29 15:59:48 kingsmere MailScanner[9871]: Uninfected: Delivered 1 messages
The message included in the e-mail was the usual "Uninfected" message.
So what do I do now?
Alex Vandenham
Avantel Systems
=============
On April 28, 2004 09:30 am, S Karthikeyan wrote:
> Dear Alex,
>
> > Here's a more pertinent selection from the mail log files showing that a
> > virus was found and yet the conclusion and marking in the e-mail was
> > "Uninfected". How can I get that fixed?
> >
> > Apr 27 17:39:24 kingsmere MailScanner[29517]: Virus and Content Scanning:
> > Starting
> > Apr 27 17:39:30 kingsmere MailScanner[29517]:
> > /usr/share/spool/MailScanner/incoming/29517/./i3RLctN00386/dinner.zip:
> > Worm.SomeFool.Gen-2 FOUND
> > Apr 27 17:39:30 kingsmere MailScanner[29517]: Virus Scanning: ClamAV
> > found 1 infections
> > Apr 27 17:39:35 kingsmere MailScanner[29517]:
> > /usr/share/spool/MailScanner/incoming/29517/i3RLctN00386/dinner.zip/dinne
> >r.scr INFECTED I-Worm.NetSky.c
> > Apr 27 17:39:35 kingsmere MailScanner[29517]: Virus Scanning: Kaspersky
> > found 1 infections
> > Apr 27 17:39:35 kingsmere MailScanner[29517]: Virus Scanning: Found 1
> > viruses Apr 27 17:39:36 kingsmere MailScanner[29517]: Uninfected:
> > Delivered 1 messages
> >
> > The resulting e-mail was marked as:
>
> The msg.zip file is being detected properly in one of our test machines.
> It was detected in both OpenProtect-5.0.1.5 and 5.0.1.6.
>
> The warning is as below:
>
> This is a multi-part message in MIME format.
>
> --13WHI15H11-=-D13RQSW6VO-CUT-HERE-AJO2N1CH53-=-S6CZC1DIWZ
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> Warning: This message has had one or more attachments removed
> Warning: (details.txt .pif, msg.zip).
> Warning: Please read the "examplq-Attachment-Warning.txt" attachment(s)
> for more information.
>
> sample from alex
>
> --13WHI15H11-=-D13RQSW6VO-CUT-HERE-AJO2N1CH53-=-S6CZC1DIWZ
> Content-Type: text/plain;
> charset="us-ascii";
> name="examplq-Attachment-Warning.txt"
> Content-Disposition: attachment; filename="examplq-Attachment-Warning.txt"
> Content-Transfer-Encoding: quoted-printable
>
> This is a message from the OpenProtect E-Mail Virus Protection Service
> ----------------------------------------------------------------------
> The original e-mail attachment "msg.zip"
> was believed to be infected by a virus and has been replaced by this
> warning message.
>
> If you wish to receive a copy of the *infected* attachment, please
> e-mail helpdesk and include the whole of this message
> in your request. Alternatively, you can call them, with
> the contents of this message to hand when you call.
>
> At Wed Apr 28 13:26:06 2004 the virus scanner said:
> ClamAV: details.txt .pif contains Worm.SomeFool.P=20
> MailScanner: Shortcuts to MS-Dos programs are very dangerous in
> email (d=
> etails.txt .pif)
> No programs allowed (details.txt .pif)
>
> Note to Help Desk: Look on OpenProtect at examplq in
> /var/spool/MailScanner= /quarantine/20040428 (message 767885).
> --=20
> Postmaster
>
> cheers,
> Karthikeyan, S.
--
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
