[Mimedefang] Problem running clamd but not clamscan

[Ole Craig]

On 01/28/04 at 08:00, 'twas brillig and Scott Harris scrobe:
> Subject: [Mimedefang] Problem running clamd but not clamscan
> 
> I've been debugging why I've not been catching the 
> new worm going around for the last day.  This morning 
> I finally received a new message that passed through 
> my new configuration and was finally caught.  What I 
> had to do in order to get it to scan is alter 
> mimedefang-filter and change the order of the calls to:
> 
>     return message_contains_virus_clamav()   if ($Features{'Virus:CLAMAV'});
>     return message_contains_virus_clamd()    if ($Features{'Virus:CLAMD'});
> 
> After swapping the first two tests to appear as they 
> do now above, the very first virus with the myDoom 
> signature was caught.  Why isn't clamd catching this?  
> Clamd was able to catch other virii if I send tests 
> from www.testvirus.org.
> 
> Configuration is sendmail 8.12.11 --> mimedefang 2.39 --> clamAV 0.65, SA
> 2.63
> Clam is listening on a local socket, not tcp/ip.

Scott, et al -
	I had similar issues with clamd versus clamscan (see
lists.roaringpenguin.com/pipermail/mimedefang/2003-December/018671.html)
but nobody else seemed to (or at least, nobody responded) and I gave
up due to lack of time. (Figuring, "I've got a solution that works for
my current mail load, why fsck with it...")

		Ole
-- 
Ole Craig * UNIX, linux, SMTP-ninja; news, web; SGI martyr * CS Computing
Facility, UMass * <www.cs.umass.edu/~olc/pgppubkey.txt> for public key

	Where are the missing deficit-reduction-related activities?