[HLUG] clamav virus protection - is it working?

[Andrew Hodgson]

Hi,

A good virus sender site is:

http://www.declude.com/Articles.asp?ID=99

This allows you to send a variety of Eicar files encoded in different
formats - not all virus checkers will be able to look at all the formats,
but the majority should test OK.

There is also a spam tester, but it isn't really designed for Spamassassin.

Thanks.
Andrew.

-----Original Message-----
From: herefordshire-bounces at mailman.lug.org.uk
[mailto:herefordshire-bounces at mailman.lug.org.uk] On Behalf Of alabaster
Sent: 27 February 2006 23:33
To: Herefordshire Linux Users Group.
Subject: Re: [HLUG] clamav virus protection - is it working?

Hi John,

I checked the web site and created an antivirus test file eicar.com,
sent it to myself and the filter calling clamscan picked it up and put
it in the virus folder. So it works. Great.

Regards

Gordon

On Mon, 2006-02-27 at 09:14 +0000, John Hedges wrote:
> Hi Gordon
> 
> You can get a test virus from:
> 
> http://www.eicar.org/anti_virus_test_file.htm
> 
> Cheers
> 
> John
> 
> On Sun, Feb 26, 2006 at 06:23:27PM +0000, alabaster wrote:
> > Hi Andrew,
> > 
> > Thanks for the reply. I have re-read the articles in light of your
> > comments to try to see where I go next. One article says "... you can
> > also use it as a drop-in virus checker for an email client like KMail or
> > Evolution, by simply filtering through the clamav command."
> > 
> > I am using Evolution Mail, and I have set a filter to pipe the incoming
> > message to clamscan - (man clamscan suggested use of -, which seems to
> > scan just the piped file whereas leaving this off results in scanning
> > all of home) and if the return code is > 0 move file to folder virus. 
> > 
> > As an alternative I have set up a script clammail to scan the inbox, so
> > I can doublecheck in case of problems.
> > 
> > Does this seem right to you? If so, all I need now is a mail message
> > with a virus in to prove it works!
> > 
> > 
> > 
> > Regards
> > 
> > Gordon
> > 
> > On Mon, 2006-02-20 at 08:02 +0000, Andrew Hodgson wrote: 
> > > Hi,
> > > 
> > > ClamAV will not scan your mail in this way - the Clamd daemon is to
scan
> > > specific files when they pass through the daemon, it is not an on
access
> > > scanner.  To do ClamAV for mail, you need a plug-in to an MTA or MUA
that
> > > will pass the mail through ClamAV.  I only have experience with MTA
> > > scanning.
> > > 
> > > Thanks.
> > > Andrew.
> > > 
> > > -----Original Message-----
> > > From: herefordshire-bounces at mailman.lug.org.uk
> > > [mailto:herefordshire-bounces at mailman.lug.org.uk] On Behalf Of
alabaster
> > > Sent: 19 February 2006 23:39
> > > To: Herefordshire Linux Users Group.
> > > Subject: [HLUG] clamav virus protection - is it working?
> > > 
> > > I recently installed clamav after reading about it in LFX mag. in the
> > > hope that it will scan my mail for viruses. I can do a scan of my home
> > > page with eg
> > > 
> > > clamscan -r -l scan.txt /home/gordon
> > > 
> > > and I even found a virus in a deleted spam mail message, so something
is
> > > working.
> > > 
> > > I have modified both clamd.conf and freshclam.conf along the lines in
> > > the LFX article to create specific log files.
> > > 
> > > I did a manual database update and then started freshclam -d to update
> > > it regularly. I expected to see this as a service "freshclam" but
could
> > > not see it?
> > > 
> > > I also started clamd and can see this as a service.
> > > 
> > > I read the documentation and there was a lot I just did not understand
> > > but I think I got the main bits. The rest seemed to be other options
and
> > > features possibly related to running servers!
> > > 
> > > My problem is that I am not sure if clamav is going to scan my
incoming
> > > (or outgoing) emails. How can I check? 
> > > 
> > > Regards
> > > 
> > > Gordon
> > > 
> > > 
> > > 
> > > 
> > > _______________________________________________
> > > Herefordshire mailing list
> > > Herefordshire at mailman.lug.org.uk
> > > http://mailman.lug.org.uk/mailman/listinfo/herefordshire
> > > 
> > > 
> > > **********************************************************************
> > > This email and any files transmitted with it are confidential and
> > > intended solely for the use of the individual or entity to whom they
> > > are addressed. If you have received this email in error please notify
> > > the system manager.
> > > 
> > > allpay.net Limited, Fortis et Fides, Whitestone Business Park,
Whitestone, Hereford, HR1 3SE. Telephone: 0870 243 3434, Fax: 0870 243 6041.
Website: www.allpay.net Email: enquiries at allpay.net
> > > **********************************************************************
> > > 
> > > 
> > > _______________________________________________
> > > Herefordshire mailing list
> > > Herefordshire at mailman.lug.org.uk
> > > http://mailman.lug.org.uk/mailman/listinfo/herefordshire
> > 
> > 
> > _______________________________________________
> > Herefordshire mailing list
> > Herefordshire at mailman.lug.org.uk
> > http://mailman.lug.org.uk/mailman/listinfo/herefordshire
> 
> _______________________________________________
> Herefordshire mailing list
> Herefordshire at mailman.lug.org.uk
> http://mailman.lug.org.uk/mailman/listinfo/herefordshire


_______________________________________________
Herefordshire mailing list
Herefordshire at mailman.lug.org.uk
http://mailman.lug.org.uk/mailman/listinfo/herefordshire