Quoting John Fleming <[EMAIL PROTECTED]>:
Hanford, Seth wrote:
clamav.conf is used by clamd for configuration parameters. Try running clamscan --mbox to get the detection. It _may_ not work because of the definition of EICAR, which IIRC is fairly strict and has the "virus" starting at the very beginning of the file. It should work with clamscan --mbox with EICAR attached, as opposed to being in the body of the message.
Well, clamscan is being called from the Clamassassin script. Are you saying I should call clamscan with the --mbox option in that script?
I believe that was what he was referring to, yes.
2. I don't seem to have anything related to clamd - Why? How to run clamd? My system has no knowledge of clamd or clamdscan. Differences between running clamd vs clamscan? I have a low volume machine.
Clamd is probably not necessary on a low-volume machine, but it allows faster scanning through local Unix sockets, or for shared scanning via TCP sockets. You should be ok to run clamscan --mbox; if you notice a slowdown in mail, look for .deb's with clamd (assuming that, like some distributions, they have been separately packaged.)
Maybe I should try starting with an original clamav download instead of using apt-get and whatever comes with the Debian dist. Isn't it a problem that I don't even have clamav.conf?? I'll see if I get any other responses/ideas before proceeding. THANKS! - John
I am using clamscan on a machine which gets about 500-600 messages/day without any problems. It typically takes about 1-3 seconds to scan each message so this is good for me.
Since clamscan does not use clamav.conf, it really isnt a problem that you dont
have a clamav.conf. I suspect apt-get has clamscan and clamd/clamdscan as
seperate packages and you only got the clamscan one. since clamscan works when
ran manually i dont think it is necessary to to download the standard dist from
clamav. It sounds like more of a configuration problem with clamassassin than
anything else. I have never used clamassassin however, so i cant verify this.
Perhaps someone with more knowledge of this program can help.
Jim
-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users