Re: [Exim] OT: Virus passes....

Hi Tom,

Tom Kistner <tom@???> wrote:

> Yes. If that header is present, then exiscan has properly detected the
> virus, but the "pass" action was used:

> > X-Infected: Found the W32/Hybris.gen@MM virus !!!

> The problem must be after exiscans operation point.


Yes, okay, I think so to. As I have a redirect = virusalert in the exiscan
config I don't think it used the pass directive. It redirected the message
all right to the virusalert (as I could see in the logs) but the exim
system filter did not handle this message.
I tried to send both the .exe and the .scr file manually again through exim
(both servers) and exiscan with uvscan detected the virus AND the system
filter did what it is expected to do - send out warning messages...

So the question is still why the system filter has not been used for these
to emails.
Is it possible that there are sometime failures where a messages is just
redirected and the system filter doesn't care at all?

I have no idea why this happened...
Who has other/more ideas?

Michael