[Mimedefang] clamav oddity

[Bill Randle]

Ashley M. Kirchner wrote:

> David F. Skoll wrote:
>
>> Give clamscan the "--mbox" argument.  That might make it recognize 
>> the virus.
>>  
>>
>    Thanks David.  That made it recognize only two out of an entire 
> directory containing 55 qdirs, each containing a virus.  Something's 
> not playing nice here.  Obviously when MIMEDefang scans it when the 
> message comes in initially, it sees the virus (and I can verify that 
> with Norton AntiVirus) so I know clamav itself is working properly 
> through MIMEDefang (and that the database is up to date and all.)  
> What I don't understand is why when I manually run clamscan, it won't 
> find (all of) them.

Have you updated clamav recently? Is is possible you have more than one  
copy of the virus
definition tables installed? While clamd will get the path to the db 
files from the /etc/clamav.conf
file, clamscan does not read the config file and uses its internal 
defaults unless you override
it via command line args. Try running clamscan (with --mbox) and with 
the arg that explicitly tells
it where to find the db files (get the path from /etc/clamav.conf or 
/etc/freshclam.conf [which should
be the same]).

    -Bill