Hi, I'm running clamav with qmail on Debian Stable Linux. * My .qmail file for any particular user looks like this: |/usr/local/bin/clamdscan -d /usr/local/share/clamav -* My testbox is working fine, but I've noticed on a clean system that if I send a test eicar virus to an email account, it seems like qmail keeps attempting to deliver and clamav keeps blocking. This happens for about a week, then the test virus gets auto-emailed back to me as a failure to deliver notice. * My concern is that the system is kept extra busy with this delivery-attempt-then-block activity. * Wouldn't the virus-bearing email just get deleted and stay deleted? * How could I fix this so that the email is deleted the first time it is detected? * Thanks, -Rick
Part of Clamav.log below (notice Eicar keeps being discovered over and over) Wed Oct 6 18:37:42 2004 -> Self checking every 3600 seconds. Wed Oct 6 18:37:45 2004 -> stream: Eicar-Test-Signature FOUND Wed Oct 6 18:37:46 2004 -> stream: Eicar-Test-Signature FOUND Wed Oct 6 20:29:35 2004 -> No stats for Database check - forcing reload Wed Oct 6 20:29:35 2004 -> stream: Eicar-Test-Signature FOUND Wed Oct 6 20:29:35 2004 -> Reading databases from /var/lib/clamav/ Wed Oct 6 20:29:36 2004 -> Database correctly reloaded (24215 viruses) Wed Oct 6 20:29:36 2004 -> stream: Eicar-Test-Signature FOUND __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
