[Mimedefang] File::Scan

[Nels Lindquist]

On 20 Mar 2003 at 18:47, alan premselaar wrote:

> i'm using MIMEDefang 2.30 / File::Scan v0.44 / Spamassassin 2.50 / Sendmail
> 8.12.8 and i've noticed a few files that are returning as having found a
> virus, but the virusname is empty.

> these are Excel files (.xls) that apparently have macros in them, although
> supposedly some do not.

Are you using the default mimedefang-filter which comes with 
MIMEDefang, or did you write the code for calling the 
*_contains_virus_filescan() functions yourself?

If the latter, are you sure it's returning a virus code and not a 
"suspicious" code?  File::Scan seems to be overly paranoid especially 
where Office documents with potential macros are concerned, and will 
often return a "suspicious" response for clean documents.

If your mimedefang-filter is set to ignore such responses you might 
have better luck.

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.