RE: [AMaViS-user] McAfee uvscan failure to clean

[<Joh...@os...>]

Hi

12 - The scanner tried to clean a file, and that clean failed for some
reason and the file is still infected. 

"The file has been deleted."

It can't clean the file and therefor deletes it before delivering the
e-mail.

Regards Johan


-----Original Message-----
From: Shelley Waltz
To: ama...@li...
Sent: 4/12/2004 7:18 PM
Subject: [AMaViS-user] McAfee uvscan failure to clean

I am using the latest version on amavisd-new on RH ES3.
If I use a file infected with Netssky as a test, I can cleanse the file
using uvcscan in command line mode ...

uvscan --secure -rv --mime --summary --analyze --clean --cleandocall
x.pif
Scanning /var/amavisd/tmp/x.pif
Scanning file /var/amavisd/tmp/x.pif
/var/amavisd/tmp/x.pif
        Found the W32/Netsky.d@MM virus !!!
        The file has been deleted.

Summary report on /var/amavisd/tmp/x.pif
File(s)
        Total files: ...........       1
        Clean: .................       0
        Possibly Infected: .....       1
        Cleaned: ...............       0
        Deleted: ...............       1

When I mail the file and use amavisd-new to call uvscan,
it detects the virus, but fails to cleanse it and simply sends it
through without even a X-Virus-Warning: INFECTED status.

Here is the point of failure ...

Apr 12 12:34:11  amavisd[14354]: (14354-01) 
Using 
NAI McAfee AntiVirus (uvscan): /usr/local/bin/uvscan --secure -rv --mime

--summary --analyze --noboot --clean --cleandocall - 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts
Apr 12 12:34:11  amavisd[14354]: (14354-01) 
run_command: [14363] /usr/local/bin/uvscan --secure -rv --mime --summary

--analyze --noboot --clean --cleandocall - 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts </dev/null 2>&1
Apr 12 12:34:11  amavisd[14354]: (14354-01) 
run_av: /usr/local/bin/uvscan status=12 (3072 ),Scanning 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts/*\nScanning file 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts/part-00001\nScanning

file 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts/part-00002\n/var/ama
visd/tmp/amavis-20040412T123411-14354/parts/part-00002\n...Found 
the W32/Netsky.d@MM virus !!!\n...The file has been deleted.\n\nSummary 
report on 
/var/amavisd/tmp/amavis-20040412T123411-14354/parts/*\nFile(s)\n...Total

files: ........... ...2\n...Clean: ................. ...1\n...Possibly 
Infected: ..... ...1\n...Cleaned: ............... ...0\n...Deleted: 
............... ...1
Apr 12 12:34:11 chipmunk.cabm.rutgers.edu amavisd[14354]: (14354-01)
Virus 
scanner failure: /usr/local/bin/uvscan (exit status: 12)

Any clues or suggestions appreciated.
Shelley Waltz



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
AMaViS-user mailing list
AMa...@li...
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/