Hi, I do run a mailserver using Mailmax 5.5. It does have an option to scan incoming emails with an external AV. I have tried for several hours but I do probably miss anything somewhere. Any help will be welcome ! Running on W2K3 SP2 server.

If %d is placed in the command line, SMTPMax (mailmax component) will replace it with the path to the directory where an extracted file(s) attachment may be found. If the virus program removes any files from the directory, then the email will be considered virus infected and will be discarded. The %d is case sensitive.

Examples I have found :

"C:\Program Files\Sophos\sav32cli.exe" -di -ss -nb -nc -all -remove -archive %d

C:\av\avgscan.exe /clean /scan /arc %d

What I have written :

C:\Program Files\ClamWin\bin\clamscan.exe --verbose --tempdir=%d --remove=yes

Unfortunately, it seems not detecting any virus strain (EICAR or others)

I need to check all the compressed files, executables, macros, have a log file (if possible), get an email about the virus (if possible)

Many thanks for your help, time and support.

You can download mailmax 5.5 from https://www.smartmax.com if needed.
Michel

I have been able to have it running, but with some kind of issues :

Here is the batch used and the command line :

CD C:\Program Files\ClamWin\bin
clamscan.exe --file-list=%~f1\*.* --remove -l C:\VIRTEST\Log.txt --detect-pua=yes --phishing-sigs=yes --algorithmic-detection=yes --scan-pe=yes --scan-elf=yes --scan-ole2=yes --scan-pdf=yes --scan-html=yes --scan-archive=yes --database="C:\Documents and Settings\All Users\.clamwin\db"

--file-list=%~f1\*.* is used to get the full path and files to be scanned, as Mailmax does anonymize the files.

I get the results as follows, as I have also checked the path to be sure it was working :

fully qualified name C:\MailMax5\InBound\__63\*.* (I do add the *.* and the __Number changes every new message containing attachments)

Results written into the Log file :


-------------------------------------------------------------------------------


----------- SCAN SUMMARY -----------
Known viruses: 637363
Engine version: 0.95.2
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 8.903 sec (0 m 8 s)

It seems that for any reason it is not targetting the right place / or detecting the files to be scanned.

Thanks for your advices
Michel

i am not sure if this will help, but you might try putting a "dummy" signature in the clamwin\bin directory. i have to do this when working malware so i can get a copy of the clam temp file from which to prepare a signature. here is my dummy sig in a notepad file i call Fakesig.ndb

Fakesig:1:*:5c5c1100002000

if it doesn't work for you, just delete it.

regards,

Hi GuitarBob, the signature file seems to be loaded, so I dont think this is the issue. Anyway, I will give it a try.
Thanks. Michel.

EDIT: have procedeed has recommended. Still same issue.