Re: [AMaViS-user] Virusname contains space

Andreas,

> this morning our mcafee scanner found a virus "New Mailware.ab"
> the name contains a space which results in a warning to the user,
> that a Virus "New" was found ;-(
> I never seen before a virusname conaining spaces.
> I think this issue is mcafee related, right ?

That's 'uvscan' entry in the @av_scanners list I suppose
(in your amavisd.conf):

A regular expression to extract virus name in one case
stops the search at a space:

qr/(?x) Found (?:
\ the\ (.+)\ (?:virus|trojan) |
\ (?:virus|trojan)\ or\ variant\ ([^ ]+) |
:\ (.+)\ NOT\ a\ virus)/,

Is there any other text after a virus name in the output of
the virus scanner in the line which reports a virus name?

Please show the exact line reported (for this and for some other
viruses if possible) when scanner is manually run, or experiment with
the ([^ ]+) part of the expression. Perhaps the following would do:

qr/(?x) Found (?:
\ the\ (.+)\ (?:virus|trojan) |
\ (?:virus|trojan)\ or\ variant\ (.+)$ |
:\ (.+)\ NOT\ a\ virus)/,

Mark


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/