clamav

[nzyme]

Jeff, how do i get ClamAV in SB2 ?

edit:

## Find primary_hostname and add the following line above
av_scanner = clamd:/var/run/clamav/clamd

## Find check_message:
## Make sure it looks like this:

check_message:
deny message = This message contains malformed MIME ($demime_reason)
demime = *
condition = ${if >{$demime_errorlevel}{2}{1}{0}}
deny message = This message contains a virus or other harmful content ($malware_name)
demime = *
malware = *
deny message = This message contains an attachment of a type which we do not accept (.$found_extension)
demime = bat:com:pif:prf:scr:vbs
warn message = X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
accept

## Save and exit

## Restart exim
/sbin/service exim restart

found it right here on the forums :)
http://www.directadmin.com/forum/showthread.php?threadid=10478

[jjma]

Not sure what fix you used as there are a few suggestions on that thread, each with a degree of success.

I have had to disable clamav for the moment as it was falling over with the new spamblocker.

Jon

[jlasman]

Jon, can you explain further?

Jeff

[jjma]

Sure. I upgraded our server last week to the latest spamblocker. At first I thought the install was fine until I received a complaint from a client that they couldn't send a 4mb file (our limit was 20mb, set in both /etc/clamd.conf & /etc/exim.conf) so checking the exim panicklog I noticed lots of ' clamd: connection to 127.0.0.1, port 3310 failed (Connection refused)'.

I checked the exim.conf file that clamav was installed properly, compared the conf file with the forum howto, scratched my head as it appeared to be correct. After much trail and experimentation I thought the best thing was to reinstall clamav again, delete all clam's conf files.

Reinstalling did work, test emails with virus attachments were being rejected so it appear that both exim and clam are working properly.

I found the howto slightly confusing with lots of different opinions on which is the correct way to install clamd but glad we're now protected again.

regards

Jon