[HLUG] clamav virus protection - is it working?

[John Hedges]

Hi Gordon

You can get a test virus from:

http://www.eicar.org/anti_virus_test_file.htm

Cheers

John

On Sun, Feb 26, 2006 at 06:23:27PM +0000, alabaster wrote:
> Hi Andrew,
> 
> Thanks for the reply. I have re-read the articles in light of your
> comments to try to see where I go next. One article says "... you can
> also use it as a drop-in virus checker for an email client like KMail or
> Evolution, by simply filtering through the clamav command."
> 
> I am using Evolution Mail, and I have set a filter to pipe the incoming
> message to clamscan - (man clamscan suggested use of -, which seems to
> scan just the piped file whereas leaving this off results in scanning
> all of home) and if the return code is > 0 move file to folder virus. 
> 
> As an alternative I have set up a script clammail to scan the inbox, so
> I can doublecheck in case of problems.
> 
> Does this seem right to you? If so, all I need now is a mail message
> with a virus in to prove it works!
> 
> 
> 
> Regards
> 
> Gordon
> 
> On Mon, 2006-02-20 at 08:02 +0000, Andrew Hodgson wrote: 
> > Hi,
> > 
> > ClamAV will not scan your mail in this way - the Clamd daemon is to scan
> > specific files when they pass through the daemon, it is not an on access
> > scanner.  To do ClamAV for mail, you need a plug-in to an MTA or MUA that
> > will pass the mail through ClamAV.  I only have experience with MTA
> > scanning.
> > 
> > Thanks.
> > Andrew.
> > 
> > -----Original Message-----
> > From: herefordshire-bounces at mailman.lug.org.uk
> > [mailto:herefordshire-bounces at mailman.lug.org.uk] On Behalf Of alabaster
> > Sent: 19 February 2006 23:39
> > To: Herefordshire Linux Users Group.
> > Subject: [HLUG] clamav virus protection - is it working?
> > 
> > I recently installed clamav after reading about it in LFX mag. in the
> > hope that it will scan my mail for viruses. I can do a scan of my home
> > page with eg
> > 
> > clamscan -r -l scan.txt /home/gordon
> > 
> > and I even found a virus in a deleted spam mail message, so something is
> > working.
> > 
> > I have modified both clamd.conf and freshclam.conf along the lines in
> > the LFX article to create specific log files.
> > 
> > I did a manual database update and then started freshclam -d to update
> > it regularly. I expected to see this as a service "freshclam" but could
> > not see it?
> > 
> > I also started clamd and can see this as a service.
> > 
> > I read the documentation and there was a lot I just did not understand
> > but I think I got the main bits. The rest seemed to be other options and
> > features possibly related to running servers!
> > 
> > My problem is that I am not sure if clamav is going to scan my incoming
> > (or outgoing) emails. How can I check? 
> > 
> > Regards
> > 
> > Gordon
> > 
> > 
> > 
> > 
> > _______________________________________________
> > Herefordshire mailing list
> > Herefordshire at mailman.lug.org.uk
> > http://mailman.lug.org.uk/mailman/listinfo/herefordshire
> > 
> > 
> > **********************************************************************
> > This email and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they
> > are addressed. If you have received this email in error please notify
> > the system manager.
> > 
> > allpay.net Limited, Fortis et Fides, Whitestone Business Park, Whitestone, Hereford, HR1 3SE. Telephone: 0870 243 3434, Fax: 0870 243 6041. Website: www.allpay.net Email: enquiries at allpay.net
> > **********************************************************************
> > 
> > 
> > _______________________________________________
> > Herefordshire mailing list
> > Herefordshire at mailman.lug.org.uk
> > http://mailman.lug.org.uk/mailman/listinfo/herefordshire
> 
> 
> _______________________________________________
> Herefordshire mailing list
> Herefordshire at mailman.lug.org.uk
> http://mailman.lug.org.uk/mailman/listinfo/herefordshire