Re: [Exim] ClamAV + exiscan missing virus

Top Page
Delete this message
Reply to this message
Author: David Saez
Date:  
To: exim-users
Subject: Re: [Exim] ClamAV + exiscan missing virus
Hi !!

> > My exim-4.24 w/ exiscan-acl patch 13 and clamav-0.60 installation is
> > letting
> > the Worm.Mimail.C virus through.


We have the same problem, both clamscan and clamdscan caught the virus,
but not exiscan.

> >       # clamscan /tmp/photos.zip
> >       /tmp/photos.zip: File size limit exceeded.
> >       /tmp/photos.zip: Worm.Mimail.C FOUND


we get the same File size limit exceeded warning altough clamd.conf has
a sizelimit of 10Mb :!

I've made some preliminar tests on exiscan clamd support and clamd daemon
is returning a clear OK to exiscan. BTW clamdscan uses CONTSCAN and exiscan
uses SCAN, I tried to change exiscan to also use CONTSCAN and then it
correctly detects the virus, so maybe it's some kind of bug on clamd way
of handling SCAN. What is strange is that some users are able to detect
the virus using exiscan.

--
Best regards ...

If at first you DO succeed, try not to look astonished!

----------------------------------------------------------------
   David Saez Padros                http://www.ols.es
   On-Line Services 2000 S.L.       e-mail  david@???
   Pintor Vayreda 1                 telf    +34 902 50 29 75
   08184 Palau-Solita i Plegamans   movil   +34 670 35 27 53
----------------------------------------------------------------