[Declude.Virus] ClamAV Error-Looking For Suggestions

2008-03-28 Thread Brian T 
I recently switch my antivirs over to ClamAV and now my virus log is showing 
the following errors:

 03/28/2008 12:56:17.781 q22fc01b601b4.smd Virus scanner 1 reports exit 
code of 40
 03/28/2008 12:56:19.984 q22fc01b601b4.smd Could not find report file 
C:\IMail\spool\proc\work\D22fc01b601b4.vir\report.txt.
 03/28/2008 12:56:20.000 q22fc01b601b4.smd Error 40 in virus scanner 1.
 03/28/2008 12:56:20.453 q22fc01b601b4.smd Scanned: Error in virus 
scanner. [MIME: 2 3032]
 03/28/2008 12:56:21.828 q231001b601d6.smd Virus scanner 1 reports exit 
code of 40

 What I have in my virus.cfg file is as follows:

 #Runclamscan log levels

 # log=0 (No Logging)

 # log=1 (minimal logging only date, time. elapsed times, viruses)

 # log=2 (log all messages same as 1)

 # log=3 (debug log - whole bunch of stuff - multiple lines)

 SCANFILE c:\imail\declude\runclamscan.exe log=1
 C:\clamav-devel\bin\clamdscan.exe --quiet --max-ratio 0 --max-space  1M -l 
report.txt

 VIRUSCODE 1

 REPORT FOUND

I am hoping that someone on the list might have some suggestions.

Thanks in advance.

Brian Thompson 




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.

Re: [Declude.Virus] Current Version of Clam AV

2007-03-01 Thread Brian T. 
Does anyone know of a way to fix this problem with the leftover .vir 
directories?

I was thinking about switching to ClamAV from F-Prot but don't want to 
constantly be cleaning up leftover files.

Thanks,

Brian 
  - Original Message - 
  From: Darrell ([EMAIL PROTECTED]) 
  To: declude.virus@declude.com 
  Sent: Tuesday, February 27, 2007 11:44 AM
  Subject: Re: [Declude.Virus] Current Version of Clam AV


  In my normal maintenance window (once a week) all services are stopped and I 
clean out the work, error, proc, spool, and review folders.  Since I stop 
CLAMAV as well I am able to delete those directories.

  Darrell

  
  Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.
- Original Message - 
From: Stephan 
To: declude.virus@declude.com 
Sent: Tuesday, February 27, 2007 11:22 AM
Subject: Re: [Declude.Virus] Current Version of Clam AV


Thanks for responding. I can't delete them until I restart the ClamAV 
service. Do you have a way of automatically deleting them, or do you schedule a 
task to restart ClamAV and then delete them? I tried using a schedule task but 
for some reason they still don't get deleted (but it's possible to do it 
manually.)

-Original Message-
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
Sent 2/27/2007 10:17:46 AM
To: declude.virus@declude.com
Subject: Re: [Declude.Virus] Current Version of Clam AV

 
FWIW - I have always had left over directories from .84 on up.

Darrell

Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.
  - Original Message - 
  From: Stephan 
  To: declude.virus@declude.com 
  Sent: Tuesday, February 27, 2007 8:41 AM
  Subject: Re: [Declude.Virus] Current Version of Clam AV


  I am also running the 0.90-1, and it's working fine, except I still get 
leftover .vir directories inside the declude/proc dir. The error in the clamav 
log shows:
  - d:\imail\spool\proc\work\d716a0~1.vir\/0: Unable to create temporary 
directory ERROR
  I've tried checking permissions, and made sure I have the clamav tmpdir 
variable set to my clamav tmp dir (which fixed a similar error that stopped the 
clamav service from starting.) But I haven't been able to fix this one. Anyone 
know how to fix this error?
  Thanks.

  -Original Message-
  From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
  Sent 2/26/2007 1:30:43 PM
  To: declude.virus@declude.com
  Subject: Re: [Declude.Virus] Current Version of Clam AV


Gary,

I upgraded on Friday and have not ran into any issues.

Darrell


Check out http://www.invariantsystems.com for utilities for Declude And 
Imail.  IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG 
Integration, and Log Parsers.

- Original Message - 
From: Gary Steiner [EMAIL PROTECTED]
To: declude.virus@declude.com
Sent: Monday, February 26, 2007 1:01 PM
Subject: RE: [Declude.Virus] Current Version of Clam AV


I see that SOSDG released a new version (0.90-1) of their Windows port of 
ClamAV on 02-22-2007.

http://www.sosdg.org/clamav-win32/

Has anyone upgraded to it yet?  Any problems?

Gary Steiner



 Original Message 
 From: Mark Reimer [EMAIL PROTECTED]
 Sent: Friday, February 16, 2007 2:04 PM
 To: declude.virus@declude.com
 Subject: RE: [Declude.Virus] Current Version of Clam AV

 Clam AV releases prior to 0.90 have Dos issues I believe. Is their a 0.90
 release for windows?



 Mark Reimer

 IT System Admin

 American CareSource

 972-308-6887



   _

 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mark
 Reimer
 Sent: Friday, February 16, 2007 10:06 AM
 To: declude.virus@declude.com
 Subject: [Declude.Virus] Current Version of Clam AV



 What is the current release of Clam AV for windows? I saw 0.90 stable is 
 out
 now.



 Mark Reimer

 IT System Admin

 American CareSource

 972-308-6887









---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.




---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.


  ---
  This E-mail came from the Declude.Virus mailing list. To
  unsubscribe, just send an E-mail to [EMAIL PROTECTED],

[Declude.Virus] Problem after Installing ClamAv

2006-11-10 Thread Brian T. 
The other day I installed ClamAV as a second virus scanner on our mail 
server.  I added the entires in the virus.cfg file and everything appear to 
be working.


The next day I checked the virus folder and there was nothing there, so I 
checked the proc folder and then the work folder for declude.


Any time that a virus was detected it was being held in my work folder.  If 
I tried to delete it, I got a file in use error.  I was able to delete them 
if I restarted the server.


If I comment out the lines for ClamAV in the virus.cfg file, everything 
works fine.  I assume then that the problem is in my ClamAv either the setup 
or in the line in the virus.cfg file.


I am posting the lines from my virus.cfg file and I hope someone who is 
runnning multiple scanners and ClamAV will see something in the setup that 
will fix this problem.


Thanks in advance,

Brian T.


#= SCANFILE SETTINGS 



# SCANFILE is the location of the command-line virus scanner. Note that it 
must include the full path.


# VIRUSCODE is the code that scanner returns if it finds a virus.

#[MORE INFO SEE VIRUS CONFIGURATION 
http://www.declude.com/Articles.asp?ID=117 FOR DETAILS]


SCANFILE C:\Progra~1\FSI\F-Prot\fpcmd.exe /Type /Silent /Archive=5 /PACKED 
/Dumb /Noboot /Nomem /Server /Report=report.txt


VirusCode 3

VirusCode 6

VIRUSCODE 8

Report Infection

VIRUSCODE 13

OKCode 5

#CLAMAV

#SCANFILE 
C:\Progra~1\clamwin\bin\clamscan.exe --verbose --database=C:\docume~1\alluse~1\.clamwin\db 
--tempdir=c:\Temp --no-summary -l report.txt


#VIRUSCODE 1

#SCANFILE2 C:\clamav-devel\runclamd\runclamscan.exe log=0 
C:\clamav-devel\bin\clamdscan.exe --quiet --mbox -l report.txt


#VIRUSCODE2 1

#REPORT2 FOUND





---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.Virus.The archives can be found
at http://www.mail-archive.com.