[EMAIL PROTECTED] wrote: > ???? in message '[Clamav-devel] Can clamav scan the execute > file which in memory?' wrote: >> clamav-devel >> >> Hi! >> I want to know if clamav can scan the virus of a execute file in >> memory. As I know,a execute file storing in disk is not exatly as >> the same as the code of the executing process from the same >> file.Can clamav scan the virus if the file in disk is the virus? > > I'm not sure, if you know, what you are talking about. > Clamav scans files as they appear on your disk, not how they > look like in memory, when they're being executed. This is something > obvious.
Some virusscanner can "run" executables in a so called sandbox, to see what they are doing and how they look like in memory. ClamAV is (curently) not employing that method. > >> I want clamav scan the eMail's attachment in memory before > it stores >> in my sever's disk.The file may be just from the TCP/IP protocol >> stack. >> > Why? What's wrong with putting it on the servers disk and scanning it there. If file-permissions and owner are setup right, including a Random name, it is a save method. If speeds is of you concern, you could setup a ram-disk in memory and use that to write attachements To to get scanned by ClamAV. Kind Regards, Sander Holthaus _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
