uvscan / exiscan / exim4 does block viruses

I am setting up the first of three new mail servers on Debian Woody
and I am using exim4.31 with exiscan at the moment.

I have the following in my /etc/exim4/conf.d/main section:

av_scanner = cmdline:/usr/local/uvscan/uvscan --secure --summary
--noboot\
             --allole --analyse --mime --program --unzip \
             %s:password-protected|Found:(Found.*|is password-.*)

And this in the data-acl section:

acl_check_data:
   # Add Message-ID if missing
   warn condition = ${if !def:h_Message-ID: {1}}
        hosts = +relay_from_hosts
        message = Message-ID: <E$message_id@$primary_hostname>

deny  message = $found_extension files are not accepted here \n \
          If you have questions please contact sysadm-/[email protected]
      demime = com:vbs:bat:pif:scr:exe

deny message = This message contains malware ($malware_name)
     demime = *
     malware = *
     log_message = MALWARE: $malware_name


I am using vlnx416l.tar.Z because vlnxp4432l.tar.Z needs libraries
that are not available for woody.

The *.dat files are up to date, but I get no reports in the logs that
viruses are blocked.  Another mailserver blocks about 1 virus per
minute.

When I test the same syntax on the commandline, it works:

/usr/share/doc/exim4-daemon-heavy$ /usr/local/uvscan/uvscan --secure\
  --allole --mime --noboot --analyse --unzip\
  --summary /tmp/*.zip



/tmp/body.zip
        Found the W32/[email protected]!zip virus !!!

Summary report on /tmp/body.zip
File(s)
        Total files: ...........       1
        Clean: .................       0
        Possibly Infected: .....       1

But when I send this file through the mail server it does not
complain.

I have verified that uvscan gets called from exiscan and a test using
"exim4 -d+acl -bh x.x.x.x" indicates that the malware test is used for
a normal message.

Any ideas on what can be wrong?

Is there a way to test your mail server's virusscanning before putting
it into production which is save?

Regards
Johann
--
Johann Spies          Telefoon: 021-808 4036
Informasietegnologie, Universiteit van Stellenbosch

     "But seek ye first the kingdom of God, and his
      righteousness; and all these things shall be added
      unto you."     Matthew 6:33

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers