Avast!: Name of virus is parsed incorrectly

Mark Martinec Mark.Martinec+amavis at ijs.si
Fri Aug 17 15:28:59 CEST 2012


Ralf,

> Today I had to find out why amavis wouldn't properly log the virus
> name when using the avast! Antivirus daemon.
[...]
> The config: [...]
> needs to become:
> # ### http://www.avast.com/
> # ['avast! Antivirus daemon',
> #   \&ask_daemon,       # greets with 220, terminate with QUIT
> #   ["SCAN {}\015\012QUIT\015\012", '/var/run/avast4/mailscanner.sock'],
> #   qr/\t\[\+\]/m, qr/\t\[L\]\t/m, qr/\t\[L\]\t[0-9]+ ([^[ \t\015\012]+)/m],
> All I did was to add "[0-9]+ ", since avast! seems to add a
> arbitrary(?) number, followed by a space (not \t!) to it's output.

Thanks! Will go into the next release.

> Does anybody know what this number (1759314145, 1046957622) is supposed to
> signify? Bill Landry maybe?

No idea.

  Mark


More information about the amavis-users mailing list