<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Awesome! Thanks for letting me know.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>--<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Michael D. Wood<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>ITSecurityPros.org<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>www.itsecuritypros.org<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Jayanta Ghosh [mailto:jayanta.ghosh@rp-sg.in] <br><b>Sent:</b> Friday, September 07, 2012 6:45 AM<br><b>To:</b> Michael D. Wood<br><b>Subject:</b> Re: Eicar Testing<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Dear Michael,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Thank you for your response. I have uncommented the lines and now its working.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Regards,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Jayanta<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <o:p></o:p></span></p></div><div><div><p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:mike@itsecuritypros.org" title="mike@itsecuritypros.org">Michael D. Wood</a> <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>Sent:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> Friday, September 07, 2012 3:40 PM<o:p></o:p></span></p></div><div><p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>To:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:jayanta.ghosh@rp-sg.in" title="jayanta.ghosh@rp-sg.in">'Jayanta Ghosh'</a> <o:p></o:p></span></p></div><div><p class=MsoNormal style='background:whitesmoke'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>Subject:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> RE: Eicar Testing<o:p></o:p></span></p></div></div></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div></div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I just looked at your amavisd.conf file…didn’t see it the first time </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Find this:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>### <a href="http://www.clamav.net/">http://www.clamav.net/</a><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>['ClamAV-clamd',<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> qr/\bOK$/m, qr/\bFOUND$/m,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>yours is commented out…uncomment it and see what you get.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>--<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Michael D. Wood<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>ITSecurityPros.org<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><a href="http://www.itsecuritypros.org">www.itsecuritypros.org</a><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org">amavis-users-bounces+mike=itsecuritypros.org@amavis.org</a> <a href="mailto:[mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org]">[mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org]</a> <b>On Behalf Of </b>Michael D. Wood<br><b>Sent:</b> Friday, September 07, 2012 6:01 AM<br><b>To:</b> 'Jayanta Ghosh'; <a href="mailto:amavis-users@amavis.org">amavis-users@amavis.org</a><br><b>Subject:</b> RE: Eicar Testing<o:p></o:p></span></p></div></div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I just tested with mine to see if it would detect it from the body of the e-mail and indeed it does. This was done by placing the EICAR test string in the body of the e-mail. My setup is pretty much the same except I’m using dovecot.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Things that are popping up in my head to check would be:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>/etc/amavis/conf.d/15-content_filter_mode </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>ß</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>make sure amavis is set to use clamav and spamassasin (disabled by default)<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>/etc/amavis/conf.d/15-av_scanners </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>ß</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>make sure clamd is configured here, also check to make sure clamd is running<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>### <a href="http://www.clamav.net/">http://www.clamav.net/</a><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>['ClamAV-clamd',<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> qr/\bOK$/m, qr/\bFOUND$/m,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Here is the e-mail alerting me that I had sent out the malicious e-mail:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>VIRUS ALERT<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Our content checker found<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> virus: Eicar-Test-Signature<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>in email presumably from you <<a href="mailto:mike@itsecuritypros.org">mike@itsecuritypros.org</a>> to the following recipient:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-> <a href="mailto:xxxxxxxx@gmail.com">xxxxxxxx@gmail.com</a><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Our internal reference code for your message is 13692-11/mMgsaVaBvzxz<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>First upstream SMTP client IP address: [192.168.23.62] pfsense.xxxx.xxxx According to a 'Received:' trace, the message originated at: [192.168.23.62],<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> michaellaptop pfsense.xxxxx.xxxxx [192.168.23.62] Authenticated sender:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> <a href="mailto:mike@itsecuritypros.org">mike@itsecuritypros.org</a><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Return-Path: <<a href="mailto:mike@itsecuritypros.org">mike@itsecuritypros.org</a>><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>From: "Michael D. Wood" <<a href="mailto:mike@itsecuritypros.org">mike@itsecuritypros.org</a>><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Message-ID: <<a href="mailto:00dc01cd8cdd$ab298b20$017ca160$@itsecuritypros.org">00dc01cd8cdd$ab298b20$017ca160$@itsecuritypros.org</a>><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Delivery of the email was stopped!<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Please check your system for viruses,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>or ask your system administrator to do so.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>--<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Michael D. Wood<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>ITSecurityPros.org<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><a href="http://www.itsecuritypros.org">www.itsecuritypros.org</a><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org">amavis-users-bounces+mike=itsecuritypros.org@amavis.org</a> <a href="mailto:[mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org]">[mailto:amavis-users-bounces+mike=itsecuritypros.org@amavis.org]</a> <b>On Behalf Of </b>Jayanta Ghosh<br><b>Sent:</b> Friday, September 07, 2012 5:36 AM<br><b>To:</b> <a href="mailto:amavis-users@amavis.org">amavis-users@amavis.org</a><br><b>Subject:</b> Eicar Testing<o:p></o:p></span></p></div></div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><div><div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Dear List,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:10.0pt;margin-left:.5in;line-height:13.0pt'><span style='font-size:11.0pt;color:black'>I have configured a mail server on RHEL 6.1(64 Bit) with the following components:-</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>1.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Postfix</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>2.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Courier-authlib</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>3.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Courier-imap</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>4.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>MySql</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>5.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Maildrop</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>6.</span><span style='font-size:7.0pt;color:black'> </span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Spamassassin</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>7. Clamav</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>8. Amavis-new</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in;text-indent:-.25in;line-height:13.0pt'><span style='color:black'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> The mail server is functioning properly. But I was testing the functionality of Amavis-new & Clamav. I was testing this by sending the EICAR string. The issue is when I am sending the EICAR string in the body of the email the Amavis is not detecting any virus pattern in it and eventually the email is passed by Amavis. But when I am sending the same EICAR string as an attachment (A text file containing the string ) then the Amavis is blocking the mail from getting delivered. <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>My query is do I need to change any of the settings in the clamd.conf or amavisd.conf file, So that the EICAR string written in the body of the email will be blocked by amavis. I am also attaching both the configuration herein.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Kindly help.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Regards,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Calibri","sans-serif";color:black'>Jayanta<o:p></o:p></span></p></div></div></div></div></div></div></div></body></html>