I am curious, It appears that I have missed something very important in my Clamav setup, 0.65, in that I have several examples of Maildir files that contain a known, detectable virus, that will not show as conatining such unless the file is converted to binary from mime.
I use the --mbox and --unzip options but stll no go. I do apologize if this is old hat, but I'd appreciate a point in the right direction on this. Shawn On Mon, 26 Jan 2004 21:11:50 -0600 McKeever Chris <[EMAIL PROTECTED]> exclaimed: > clamscan is finding the SCO.a fine after the attachment has been decoded > out of an email: > > /var/spool/qmailscan/quarantine/new/body.pif: Worm.SCO.A FOUND > > but it will not find it while it is still in the body of the attachment > mime encoded. > > /var/spool/qmailscan/quarantine/new/prupref-mailgate10751714524615485: OK > > > Content-Type: application/octet-stream; name="body.pif" > Content-Transfer-Encoding: base64 > Content-Description: body.pif > Content-Disposition: attachment; filename="body.pif" > > TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAA > AAAAAAAAAAAAAAAAAAAAqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA > > > Any suggestions? It finds other virii fine when they are still encoded, > maybe the definitions need to be added for its MIME version? > > thanks ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
