Quoting Tomasz Papszun <[EMAIL PROTECTED]>: > On Mon, 25 Aug 2003 at 20:12:46 -0700, [EMAIL PROTECTED] wrote: > > Jay, > > > > This one doesn't seem to match either. I am literally getting > > hundreds of these every day. Thanks for the details. > > > > Mike > > Mr Smith, could you please stop doing "top-posting"? Answering should be > done _under_ the previous message, not above it. > You quote a few levels of nested marketing footers of SF.net, also, > which adds junk and makes answering you harder. > Thank you. > > About the sample you sent to me: this is a message in Maildir format, > not Mailbox. As it has been already written a couple of times here > lately, clamscan does not (yet) recognizes messages other than mbox > format (but work is being done to extend '--mbox' capabilities). > > After I changed your sample into mbox format (by inserting 1 line > beginning with "From [EMAIL PROTECTED]"), 'clamscan --mbox' *does* > detect Sobig.F in it. I also extracted the attachment from that message > and clamscan (without any additional option) detects Sobig.F > successfully. I use usual databases. > > So I'd like to make sure: was _that particular_ sample (which you sent > to me) really allowed by a live mail system using clamav? Or you take > some infected message and manually check it with clamscan? In the latter > case, a virus will not be detected in it obviously, due to described > reason. > > -- > Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only > [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. > > > ------------------------------------------------------- > This SF.net email is sponsored by: VM Ware > With VMware you can run multiple operating systems on a single machine. > WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines > at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 > _______________________________________________ > Clamav-users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/clamav-users > Tomasz,
This is a file that has already been received by the mail system. I now under stand that this file type is unsupported by the scanner. Thanks for the answer. ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ ------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
