Browser redirection on virus detection always redirects to http://proxy.domain.dom/cgi-bin/clwarn.cgi regardless what of you configure in /etc/squidclamav.conf. Reproducible: Always Steps to Reproduce: 1.configure /etc/squidclamav.conf with directive "redirect" 2.restart clamav, c-icap and squid 3.Download EICAR Testvirus with a browser using this squid. Actual Results: Your Browser is redirected to http://proxy.domain.dom/cgi-bin/clwarn.cgi which fails since it does not exist. Expected Results: redirection to the configured website
Created attachment 336334 [details] my squidclamav configuration
Looks like this behavior only appears when you download the eicar.com and the eicar.com.txt files. If you download eicar_com.zip or eicarcom2.zip the redirection works as expected.
Maybe 6.15 version could help (bug 556306), if not, I would suggest you to report to upstream directly
Removing wrt #556306.