On Tue, 10 Feb 2004 at 17:03:27 +0100, Cedric Foll wrote: > > Some of nondetections are due to non-standard format of bounces, so new > > features are continuously added; some are because of various > > non-standard, proprietary formats used by various MTAs. There are also > > misconfigurations in submitters' systems. > > I cannot stress it too much: > > > > IT'S NOT A DATABASE PROBLEM! > > > > It would be good if submitters try to scan a "real" file (not a mail > > message, but an extracted attachment) before submitting a sample. > > Such extraction can be done with utilities like mimedecode, mimencode, > > uudeview, ripmime, reformime etc. > > I think you should write it on the web interface and even automaticly > reject with an e-mail notification each e-mail file.
No..., we aren't so lazy to simply reject any submission which is an email message. Moreover, some "viruses" are strictly connected with an email, like various HTML exploits. > I admit I've send few day ago a Dumaru.Y infected message because I > didn't know how to deal with the problem (manualy extracted attachement > was detected but clam (the web site, http://www.gietl.com/test-clamav/, > provided on this page had the same problem) wasn't able to detect the > infected e-mail). > I think that most of peoples just don't know that this kind of problem > should not be repported there. Oh, I forgot to mention one more reason of not detecting infections. Some samples are from quarantines from other AV scanners. Some of them modify messages heavily and "messages" are no longer in a email format. Obviously, ClamAV can't detect an infection in them. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
