----- Original Message -----
From: "Dennis Peterson" <[EMAIL PROTECTED]>
To: "ClamAV users ML" <clamav-users@lists.clamav.net>
Sent: Friday, March 16, 2007 8:04 PM
Subject: Re: ClamAV not LOGGING viruses was [Clamav-users] 0.90.1not
findingviruses
Tomasz Kojm wrote:
On Fri, 16 Mar 2007 19:45:10 -0400
"John Fleming" <[EMAIL PROTECTED]> wrote:
X-Virus-Status: Yes
X-Virus-Report: Eicar-Test-Signature FOUND
X-Virus-Checker-Version: clamassassin 1.2.4 with clamscan / ClamAV
^^^^^^^^
That can't be very efficient.
No, but I thought it had always been that way. Something happened when I
upgraded to 0.90.1. After I upgraded to 0.90.1, I stopped logging viruses,
and this was using clamassassin 1.2.1. Clamassassin 1.2.1 has known
freshclam problems with clamav 0.90.1, so now there is clamassassin 1.2.4 to
use with the latest clamav. I upgraded to clamassassin 1.2.4 and still
wasn't logging viruses. However, I don't see any difference in the scripts
re running clamscan or clamdscan.
HOWEVER, I ran the clamassassin (1.2.4) ./configure again, only this time I
issued ./configure --enable-clamdscan, and guess what, I'm logging viruses
again!
Fri Mar 16 20:11:36 2007 -> Self checking every 3600 seconds.
Fri Mar 16 20:12:10 2007 -> Accepted connection on port 1543, fd 8
Fri Mar 16 20:12:10 2007 -> stream 1543: Eicar-Test-Signature FOUND
Fri Mar 16 20:13:23 2007 -> Accepted connection on port 1448, fd 8
Fri Mar 16 20:13:23 2007 -> stream 1448: OK
Fri Mar 16 20:15:08 2007 -> Accepted connection on port 1341, fd 8
Fri Mar 16 20:15:08 2007 -> stream 1341: OK
Fri Mar 16 20:16:47 2007 -> Accepted connection on port 1668, fd 8
Fri Mar 16 20:16:47 2007 -> stream 1668: OK
Fri Mar 16 20:17:13 2007 -> Accepted connection on port 1657, fd 8
Fri Mar 16 20:17:13 2007 -> stream 1657: OK
Fri Mar 16 20:17:48 2007 -> Accepted connection on port 1356, fd 8
Fri Mar 16 20:17:48 2007 -> stream 1356: HTML.Phishing.Bank-1156 FOUND
And the mail headers:
X-Virus-Status: Yes
X-Virus-Report: Eicar-Test-Signature FOUND
X-Virus-Checker-Version: clamassassin 1.2.4 with clamdscan / ClamAV
0.90.1/2853/Fri Mar 16 15:48:54 2007
^^^^^^^^^
I suppose it's possible that I also configured the older clamassassin 1.2.1
to run clamdscan using the --enable option - Let me look at an old email -
Well, the headers were different then:
X-Virus-Status: No
X-Virus-Checker-Version: Luke wa9als.com running clamassassin 1.2.1 with
ClamAV 0.88/1309/Thu Mar 2 11:53:29 2006 signatures 36.1309
These didn't report clamscan vs clamdscan!
*** So my point is that one shouldn't come to the conclusion that it's just
a clamassassin configuration problem, because it was logging viruses until I
upgraded to clamav 0.90.1. At that point I was still using my
originally-configured clamassassin script. I'm not sure if it was using
clamscan or clamdscan at that point, but I am sure that I was logging
viruses and that it broke when I upgraded clamav. UPgrading clamav
shouldn't have affected clamassassin!
THANK YOU VERY MUCH! - John
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
