Dear Nigel, Here is 2 debug logs from clamd from 2 different PC.
1st - Windows 2003 Server w/o Cygwin installed: ... LibClamAV debug: messageFindArgument: compare 8 bytes of filename with filename="text.zip" LibClamAV debug: blobSetFilename: text.zip LibClamAV debug: Mixed message part 2 is of type 0 LibClamAV debug: in parseEmailBody(nBlobs = 1) LibClamAV debug: 1 attachments found LibClamAV debug: Saving attachment in /tmp/4d6f53514572dc94/text.zip LibClamAV debug: Saving attachment as /tmp/4d6f53514572dc94/text.zip002388 (22643 bytes long) LibClamAV debug: blobDestroy 1 LibClamAV debug: parseEmailBody() returning 1 LibClamAV debug: Mixed message part 2 is of type 0 LibClamAV debug: in parseEmailBody(nBlobs = 0) LibClamAV debug: 0 attachments found LibClamAV debug: 0 multiparts found LibClamAV debug: parseEmailBody() returning 2 LibClamAV debug: cli_mbox returning 0 LibClamAV debug: Scanning /tmp/4d6f53514572dc94/text.zip002388 LibClamAV debug: Recognized ZIP file file LibClamAV debug: Starting scanzip() LibClamAV debug: Zip -> text.pif, compressed: 22528, normal: 22528. LibClamAV debug: cl_filetype(): File type not recognized LibClamAV debug: Worm.SCO.A virus found in descriptor 10. LibClamAV debug: Zip -> Found Worm.SCO.A virus. OK ! 2nd - Windows XP with Cygwin installed: ... LibClamAV debug: Empty part LibClamAV debug: The message has 3 parts LibClamAV debug: Find out the multipart type(mixed) LibClamAV debug: Mixed message with 3 parts LibClamAV debug: Mixed message part 0 is of type 6 LibClamAV debug: Mixed message text part disposition "" LibClamAV debug: Adding part to main message LibClamAV debug: Mixed message part 1 is of type 1 LibClamAV debug: blobCreate LibClamAV debug: messageFindArgument: compare 8 bytes of filename with name="text.zip" LibClamAV debug: messageFindArgument: compare 8 bytes of filename with filename="text.zip" LibClamAV debug: blobSetFilename: text.zip LibClamAV debug: Mixed message part 2 is of type 0 LibClamAV debug: in parseEmailBody(nBlobs = 1) LibClamAV debug: 1 attachments found LibClamAV debug: Saving attachment in /tmp/6ff24f8c75437b35/text.zip LibClamAV debug: Saving attachment as /tmp/6ff24f8c75437b35/text.zip002748 (22643 bytes long) LibClamAV debug: blobDestroy 1 LibClamAV debug: parseEmailBody() returning 1 LibClamAV debug: Mixed message part 2 is of type 0 LibClamAV debug: in parseEmailBody(nBlobs = 0) LibClamAV debug: 0 attachments found LibClamAV debug: 0 multiparts found LibClamAV debug: parseEmailBody() returning 2 LibClamAV debug: cli_mbox returning 0 LibClamAV debug: Scanning /tmp/6ff24f8c75437b35/text.zip002748 ^^^^^^^ this is a latest line! There no "Recognized ZIP file file" etc lines! And no any error messages. Clamdscan: 1st: C:\Eserv3\antivirus\clamav\bin>-mail\DATA\infected\!3289!1114431587!2.eml" C:\Eserv3\DATA\infected\!3289!1114431587!2.eml: Worm.SCO.A FOUND ----------- SCAN SUMMARY ----------- Infected files: 1 Time: 0.126 sec (0 m 0 s) 2nd (much slower PC): G:\temp\clamav1\bin>clamdscan.exe "G:\temp\clamav1\bin\!3289!1114431587!2.eml" G:\temp\clamav1\bin\!3289!1114431587!2.eml: OK ----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.173 sec (0 m 0 s) ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
