On Mon, 25 Aug 2003 at 20:12:46 -0700, [EMAIL PROTECTED] wrote: > Jay, > > This one doesn't seem to match either. I am literally getting > hundreds of these every day. Thanks for the details. > > Mike
Mr Smith, could you please stop doing "top-posting"? Answering should be done _under_ the previous message, not above it. You quote a few levels of nested marketing footers of SF.net, also, which adds junk and makes answering you harder. Thank you. About the sample you sent to me: this is a message in Maildir format, not Mailbox. As it has been already written a couple of times here lately, clamscan does not (yet) recognizes messages other than mbox format (but work is being done to extend '--mbox' capabilities). After I changed your sample into mbox format (by inserting 1 line beginning with "From [EMAIL PROTECTED]"), 'clamscan --mbox' *does* detect Sobig.F in it. I also extracted the attachment from that message and clamscan (without any additional option) detects Sobig.F successfully. I use usual databases. So I'd like to make sure: was _that particular_ sample (which you sent to me) really allowed by a live mail system using clamav? Or you take some infected message and manually check it with clamscan? In the latter case, a virus will not be detected in it obviously, due to described reason. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
