Okay, I installed the amavis patch, and changed it to log to its own logfile. I notice that uvscan exits with an exitcode of 17 when I attach the EICAR.ZIP file, but amavis doesn't seem to think that's a bad thing, and passes the message along anyway. I also get the following delivery line in my qmail log file: delivery 9: success: File:_changing_"EICAR.COM"_to_"y13255.0.COM"(12)/CentralDir:_changing_"EICAR.COM"_to_"y13255.0.COM"/Reduced_Length:_6//usr/bin/head:_./EICAR.ZIP:_No_such_file_or_directory//usr/bin/head:_./EICAR.ZIP:_No_such_file_or_directory/did_1+0+1/ I'm going to sift through the scanmails script to see what it's doing. It appears to be running 'head' on a file that had since been renamed -- it does this, and runs grep against the head output, to determine what type of attachment the file in question is (zip, tar, arj, etc) Still hacking away, Dustin
