On Mon, 17 Nov 2003 at 16:00:52 +0100, Thomas Lamy wrote:
> René Bellora wrote:
>
> >hi!
> >
> > i've got an email containing a virus (TR.Happy99/SKA). Clamscan
> >recognizes the virus, but 'clamscan --mbox' doesn't
> >
> ># clamscan --version
> >clamscan / ClamAV version 0.65
> >
> ># clamscan unpacked/Happy99.exe
> >unpacked/Happy99.exe: TR.Happy99/SKA FOUND
> >
> ># clamscan --mbox mailpack
> >LibClamAV Warning: Multipart MIME message contains no parts
> >mailpack: OK
[...]
> > the mail sample is in http://rana.dyndns.org/mailpack
> >
> > regards,
> > René
> >
> Could you please make that one available for download, or send it
> (zipped, pw=virus) to Nigel or me for evaluation?
>
It _is_ available for download :-) - I've just got it.
BTW, I'm not a MIME expert but I think tha '--mbox' is confused probably
because the declared part isn't present at all. The attachment is
declared as
"Content-Type: multipart/alternative;
boundary="6A128_28.4_A8E6C.942""
but the declared boundary string doesn't exist in the body of the
message. The file is included as usual uuencoded body ("begin 644
Happy99.exe"), not an attachment.
--
Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only
[EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros.
[EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner
-------------------------------------------------------
This SF. Net email is sponsored by: GoToMyPC
GoToMyPC is the fast, easy and secure way to access your computer from
any Web browser or wireless device. Click here to Try it Free!
https://www.gotomypc.com/tr/OSDN/AW/Q4_2003/t/g22lp?Target=mm/g22lp.tmpl
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
