RE: [Clamav-users] Problem with *.zip atachments!
MailScanner users need to upgrade to MailScanner 4.28.4 (just out), which can block password-protected .zip files. Cheers, Phil - Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Thomas Lamy Sent: 03 March 2004 15:02 To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] Problem with *.zip atachments! Grzegorz Staleczyk schrieb: Hey There! I've got a problem with viri on *.zip attachments in e-mails! when I scan file.zip by hand clamscan find virus, but e-mail with this infected files in atachment can go (IT IS NOT STOPED!) Why? What have I wrog configured? [EMAIL PROTECTED] ~]$/usr/local/bin/clamscan freaky.zip freaky.zip: Worm.SomeFool.B.2 FOUND --- SCAN SUMMARY --- Known viruses: 20366 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.02 MB I/O buffer size: 131072 bytes Time: 10.594 sec (0 m 10 s) Mar 3 14:53:55 mail MailScanner[11494]: /export/home2/mail/incoming/11494/./i23Dps11/portmoney.zip : Worm.SomeFool.B FOUND Mar 3 14:53:56 mail MailScanner[11494]: Virus Scanning: ClamAV found 1 infections Mar 3 14:53:56 mail MailScanner[11494]: Virus Scanning: Found 1 viruses Mar 3 14:53:59 mail MailScanner[11494]: Filetype Checks: Allowing i23Dps11 portmoney.zip Mar 3 14:54:00 mail MailScanner[11494]: Virus Scanning completed at 934 bytes per second Mar 3 14:54:01 mail MailScanner[11517]: Virus Scanning completed at 86 bytes per second I have run on Solaris 8, Clam AntiVirus Scanner 0.67 , MailScanner 4.26.8 Thank for your help! Please fix your MailScanner configuration. I'm of no further help, since I don't know MailScanner, but from the logs I can see that clamAV actually _found_ the virus, but MailScanner is forwarding it. Thomas --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56alloc_id438op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56alloc_id438op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Problem with *.zip atachments!
MailScanner users need to upgrade to MailScanner 4.28.4 (just out), which can block password-protected .zip files. RP MailScanner users need to upgrade to MailScanner 4.28.4 (just out), which RP can block password-protected .zip files. I don't think about it. I install Mailscanner + ClamAv + Sendmail the same versions on on my second mail server and: Mar 3 20:52:46 dask-xp MailScanner[16052]: New Batch: Scanning 1 messages, 34631 bytes Mar 3 20:52:46 dask-xp MailScanner[16052]: MCP Checks completed at 34631 bytes per second Mar 3 20:52:46 dask-xp MailScanner[16052]: Spam Checks: Starting Mar 3 20:52:46 dask-xp MailScanner[16052]: Spam Checks completed at 34631 bytes per second Mar 3 20:52:46 dask-xp MailScanner[16052]: Virus and Content Scanning: Starting Mar 3 20:52:58 dask-xp MailScanner [16052]: /var/spool/Incoming/16052/./i23Jqixu016730/freaky.zip: Worm.SomeFool.B.2 FOUND Mar 3 20:52:58 dask-xp MailScanner[16052]: Virus Scanning: ClamAV found 1 infections Mar 3 20:52:59 dask-xp MailScanner[16052]: Infected message i23Jqixu016730 came from xxx.xxx.xxx.xxx Mar 3 20:52:59 dask-xp MailScanner[16052]: Virus Scanning: Found 1 viruses Mar 3 20:52:59 dask-xp MailScanner[16052]: Filename Checks: Allowing i23Jqixu016730 msg-16052-4.txt Mar 3 20:52:59 dask-xp MailScanner[16052]: Filename Checks: Allowing i23Jqixu016730 freaky.zip Mar 3 20:52:59 dask-xp MailScanner[16052]: Filetype Checks: Allowing i23Jqixu016730 freaky.zip Mar 3 20:52:59 dask-xp MailScanner[16052]: Filetype Checks: Allowing i23Jqixu016730 msg-16052-4.txt Mar 3 20:52:59 dask-xp MailScanner[16052]: Virus Scanning completed at 2663 bytes per second Mar 3 20:52:59 dask-xp MailScanner[16052]: Saved entire message to /var/spool/quarantine/20040303/i23Jqixu016730 Mar 3 20:52:59 dask-xp MailScanner[16052]: Saved infected freaky.zip to /var/spool/quarantine/20040303/i23Jqixu016730 Mar 3 20:52:59 dask-xp MailScanner[16052]: Cleaned: Delivered 1 cleaned messages ^ On my first mail serever with the same versions like in uppre case , and Mar 3 21:35:18 mail MailScanner[21453]: New Batch: Scanning 1 messages, 75503 bytes Mar 3 21:35:19 mail MailScanner[21453]: MCP Checks completed at 75503 bytes per second Mar 3 21:35:19 mail MailScanner[21453]: Spam Checks: Starting Mar 3 21:35:28 mail MailScanner[21453]: Spam Checks completed at 8389 bytes per second Mar 3 21:35:29 mail MailScanner[21453]: Virus and Content Scanning: Starting Mar 3 21:37:05 mail MailScanner [21453]: /export/home2/mail/incoming/21453/./i23KTFD21834/freaky.zip: Worm.SomeFool.Gen-2 FOUND Mar 3 21:37:08 mail MailScanner[21453]: Virus Scanning: ClamAV found 1 infections Mar 3 21:37:08 mail MailScanner[21453]: Virus Scanning: Found 1 viruses Mar 3 21:37:10 mail MailScanner[21453]: Filename Checks: Allowing i23KTFD21834 msg-21453-3.txt Mar 3 21:37:10 mail MailScanner[21453]: Filename Checks: Allowing i23KTFD21834 freaky.zip Mar 3 21:37:11 mail MailScanner[21453]: Filetype Checks: Allowing i23KTFD21834 msg-21453-3.txt Mar 3 21:37:11 mail MailScanner[21453]: Filetype Checks: Allowing i23KTFD21834 freaky.zip Mar 3 21:37:12 mail MailScanner[21453]: Virus Scanning completed at 75 bytes per second Why it is? Why server dask-xp stop mail with attachment freaky.zip , and mail server not stop it! Configurations are the same! --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470alloc_id=3638op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Problem with *.zip atachments!
On Wed, 2004-03-03 at 20:57, Grzesiek Staleczyk wrote: MailScanner users need to upgrade to MailScanner 4.28.4 (just out), which can block password-protected .zip files. RP MailScanner users need to upgrade to MailScanner 4.28.4 (just out), which RP can block password-protected .zip files. It only says that the filename rules would allow it - it doesn't say that the attachment will be allowed as a result of all checks. Is the attachment actually reaching the recipient? You should really try posting on the MailScanner list, as this clearly isn't a clam issue. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70alloc_id638op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
