Anti-virus, more than one program

Use this forum if you have installed hMailServer and want to ask a question related to a production release of hMailServer. Before posting, please read the troubleshooting guide. A large part of all reported issues are already described in detail here.
Post Reply
agatha
Normal user
Normal user
Posts: 49
Joined: 2015-10-30 11:13

Anti-virus, more than one program

Post by agatha » 2017-06-28 09:15

Hello,

I use clamav and for a few weeks now an additional external scanner (Avast).

My question: Are both scanners used one after another? And which one first? And what happens, when the first one recognizes a virus, ist the second one still used?

And one more issue: HM deletes attachements when a virus is found. But I think, it does not really remove it, it just does not deliver the attachement to the client. When I scan the data folder, I get still results.

I did some tests, but the results are not very clear.

Thanks
Agatha

User avatar
jimimaseye
Moderator
Moderator
Posts: 8713
Joined: 2011-09-08 17:48

Re: Anti-virus, more than one program

Post by jimimaseye » 2017-06-28 09:28

Tip: enable DEBUG logging and you will then see the order of how things are sent for av scanning and the order.

As for the attachment: it does remove the attachment. Attachments are not separate files from the email message, they are all contained as mime embeds in the same message body (ie is all in the .eml file). That file is simply modified and sent to the email client. Of You want to see the proof: send in a test message with a specific subject and attachment. After it has been stripped and delivered do a search on the data folder for that specific subject and view the .eml file.
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

agatha
Normal user
Normal user
Posts: 49
Joined: 2015-10-30 11:13

Re: Anti-virus, more than one program

Post by agatha » 2017-06-28 09:59

OK, the log helped (though it was quite large in debug mode). First the external scanner is used and if this one found no malware clamav runs. Thanks for this hint.

Post Reply