[Mimedefang] Interesting return code from TrendMicro

[Stephen Smoogen]

[root at mailproxy log]# rpm -q viruswall
viruswall-3.8-7.LANL_rhel.3
[root at mailproxy log]# rpm -q mimedefang
mimedefang-2.41-1.LANL_rhel.3

For some reason, this combination worked with 2.35/2.39 without any
problems. However, now I keep getting tempfail actions in the
interpret_trend_code subroutine. A lot of debugging statements, and it
seems to be that something is returning the code 6 versus the other
codes of 1 2

running the scan by hand on the test message gives me a return code of 1
so I am not sure what is giving it a 6?

    $VirusScannerMessages .= $msg;
    $CurrentVirusScannerMessage = $msg;
    $retcode = $? / 256;
    return ($retcode, 'ok', 'proceed');

The return from that procedure was

 6 ok proceed

Sticking in another cave-man debug to print out $? I see that if I have
1 eicar virus I get 512
2 eicar virus I get 1024
3 eicar virus I get 1536

Hmmm I think I know the problem.. just not the fix.
-- 
Stephen John Smoogen		smoogen at lanl.gov
Los Alamos National Lab  CCN-5 Sched 5/40  PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S  Los Alamos, NM 87545
-- You should consider any operational computer to be a security problem --