Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: ClamAV: users

send false positive with postfix

 

 

ClamAV users RSS feed   Index | Next | Previous | View Threaded


Philippe.Camps at impmc

May 15, 2012, 3:00 AM

Post #1 of 3 (272 views)
Permalink
send false positive with postfix

Hi,

Last friday, we had a few false positive email with
BC.Exploit.CVE_2012_0184.
The message have been quarantined as: virus-deDamcLb32uD in
/var/spool/amavis/virusmails

We use Postfix. If I scan the directory with clamdscan, no virus are
found now.

How can I say to Postfix to send these messages again ?

Thanks.
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


njones at megan

May 15, 2012, 7:01 AM

Post #2 of 3 (262 views)
Permalink
Re: send false positive with postfix [In reply to]

On 5/15/2012 5:00 AM, Philippe Camps wrote:
> Hi,
>
> Last friday, we had a few false positive email with
> BC.Exploit.CVE_2012_0184.
> The message have been quarantined as: virus-deDamcLb32uD in
> /var/spool/amavis/virusmails
>
> We use Postfix. If I scan the directory with clamdscan, no virus are
> found now.
>
> How can I say to Postfix to send these messages again ?
>

clamav has no quarantine, so this is the wrong list.

It appears you're using amavisd-new for quarantine management, so
release the message through amavisd-new. Typically the command
would be
# amavisd-release virus-deDamcLb32uD

If you have further questions about amavisd-new, consult the
amavisd-new documentation, or ask on the amavis users mail list.


-- Noel Jones
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml


Philippe.Camps at impmc

May 15, 2012, 9:03 AM

Post #3 of 3 (270 views)
Permalink
Re: send false positive with postfix [In reply to]

Le 15/05/2012 16:01, Noel Jones a écrit :
> On 5/15/2012 5:00 AM, Philippe Camps wrote:
>> Hi,
>>
>> Last friday, we had a few false positive email with
>> BC.Exploit.CVE_2012_0184.
>> The message have been quarantined as: virus-deDamcLb32uD in
>> /var/spool/amavis/virusmails
>>
>> We use Postfix. If I scan the directory with clamdscan, no virus are
>> found now.
>>
>> How can I say to Postfix to send these messages again ?
>>
> clamav has no quarantine, so this is the wrong list.
>
> It appears you're using amavisd-new for quarantine management, so
> release the message through amavisd-new. Typically the command
> would be
> # amavisd-release virus-deDamcLb32uD
>
> If you have further questions about amavisd-new, consult the
> amavisd-new documentation, or ask on the amavis users mail list.
>
>
> -- Noel Jones
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
> http://www.clamav.net/support/ml
Sorry for the inconvenience.
You learnt me this feature. I tried it and it works fine.

best regards

Philippe
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

ClamAV users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.