Interesting Daniel. I see hundreds of e-mails hitting a single account
on our server that are passing as normail e-mail through our
qmail-scanner/SA/clamav setup. IE.:
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 16021 invoked by uid 1009); 2 Sep 2003 02:24:58 -0000
Received: from [EMAIL PROTECTED] by webmail by uid 1006 with
qmail-scanner-1.16
(clamscan: 0.60. spamassassin: 2.54. Clear:SA:1(5.2/4.0):.
Processed in 0.548682 secs); 02 Sep 2003 02:24:58 -0000
X-Spam-Status: Yes, hits=5.2 required=4.0
Received: from unknown (HELO OFFICE) (24.237.26.143)
by 0 with SMTP; 2 Sep 2003 02:24:57 -0000
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Re: Wicked screensaver
Date: Mon, 1 Sep 2003 18:25:11 --0800
X-MailScanner: Found to be clean
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="_NextPart_000_06F3D714"
X-Qmail-Scanner-Message-ID: <[EMAIL PROTECTED]>
This is a multipart message in MIME format
--_NextPart_000_06F3D714
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Please see the attached file for details.
--_NextPart_000_06F3D714--
This is something I wondered about.They are all similiar except
different from fields.
Dee
On Tue, 2003-09-02 at 10:07, Daniel J McDonald wrote:
> I'm running clamav 0.60 with amavisd-new-20030616-p4/. Clam is catching
> almost all of my sobig.f viri - about 3000 a day still. But I also
> catch two or three others with the same sorts of filenames -
> Your_Application.pif, movie045.pif, etc. I have the mail nicely tucked
> away in my quarantine folder (rfc 822 format), and they appear to be
> DSNs where the mail daemon kindly included the attachment.
>
> Are these files worth tracking down and reporting? and if so, what must
> be done with them so they can have the virus extracted and identified?
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
