clamav-users October 2011 archive
Main Archive Page > Month Archives  > clamav-users archives
clamav-users: Re: [clamav-users] A trojan is not blocked

Re: [clamav-users] A trojan is not blocked

From: Chuck Swiger <cswiger_at_nospam>
Date: Tue Oct 25 2011 - 16:20:08 GMT
To: ClamAV users ML <clamav-users@lists.clamav.net>

On Oct 25, 2011, at 5:55 AM, Ivan Ivanov wrote:
> Configuration amavisd + ClamAV.
[ ... ]
> I just wondering why original message passed, but NDR (with attached original message) was blocked.

amavisd is probably not setup to pass the raw message to clamd for scanning. See whether bypass_decode_parts is on in amavisd.conf, and/or check your keep_decoded_original_maps setting. Sanesecurity has mention of this issue here:

  http://www.sanesecurity.com/problems.htm

Regards,
-- -Chuck _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml