[clamassassin-discuss] Not Scanning Attachments Properly

[James Lick]

Ted Papoulas wrote:

> I've been running SpamAssassin and procmail on my OS X server for a 
> while now, and just added ClamAssassin today, but ran into a snag. 
> When scanned directly, the test files are all identified as viruses, 
> but when sent as email attachments, they come through without a 
> problem. The email headers indicate that the message has been scanned:
> X-Virus-Checker-Version:     clamassassin 1.2.0 with clamdscan / 
> ClamAV version 0.75.1 signatures 24.438
> but it doesn't catch the virus(es).
>
> Is there something simple I'm not doing/configuring?


The most important thing to check is that you have "ScanMail" 
uncommented in your clamav.conf.  Otherwise clamd doesn't detect mail 
files.  If this is the case, then running 'clamscan --mbox' would work 
and 'clamdscan' would not when scanning a mail file.  When testing, test 
on an actual mail file with attachment instead of just the infected file 
itself, as there's some significant differences in the way ClamAV works 
if it is a mail file.  You might want to try running clamassassin with 
clamscan to see if that works correctly: './configure --disable-clamdscan'

-- 
James Lick -- 黎建溥 -- jlick at jameslick.com -- http://jameslick.com/