Viruses not being picked up

"Clive McDowell" <[email protected]> Fri, 5 Nov 2004 10:17:32 -0000
Newsgroups gmane.mail.exim.exiscan.user
Organization The Queen's University of Belfast
Message-ID <[email protected]>
Folks,

we run 3 mailhubs runing exim 4.20 which check mail for viruses using
exiscan/sophie/sophos. We have recently upgraded one of the hubs to the
latest version of exiscan and sophie (3.04rc2). The sophos engine and IDE
versions are the same on all 3 hubs. The updated hub is now not detecting
some viruses in zip attachments. I have an example message that is rejected
by the hubs running the older software but the updated hub passes it
through. Below are the data acl rules we are using -

  # Deny message if virus or other malware detected
  deny    message       = Malware $malware_name detected in zip attachment
          demime        = zip
          malware       = *

  deny    message       = Malware $malware_name detected
          demime        = *
          malware       = *

The strange thing is that viruses are being detected in some cases but not
others. Is it possible that exiscan isn't demiming some messages correctly?
Any other theories gratefully received.

Regards,

 Clive McDowell

Information Services
The Queen's University of Belfast