Hi, I have also the same problem with netsky.ab or Worm.SomeFool.AB. The message could not be recognized by clamscan. But the attached file abuses.pif alone was recognized. I'm using clamav-0.70-1 + qmail + qmail-scan combination on my mail erver. What can be the problem ? And how to solve it? Any idea_
Thanx... Ender -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Flynn Sent: Wednesday, May 05, 2004 6:33 PM To: [EMAIL PROTECTED] Subject: [Clamav-users] Re: Worm/virus not recognized locally (following my previous answer) : Now this is interesting : If I submit the internal message to the on-line scanner, it doesn't find any virus in it. so to resume : We have a Message A containing a message B containing a virus V (I hope the following array stays readable) detection? A B V on line scanner YES NO (n/a) clamscan NO NO YES I feel like I should submit my "B" files right away now, right ? Regards, Flynn ----- Original Message ----- From: "Antony Stone" <[EMAIL PROTECTED]> Newsgroups: gmane.comp.security.virus.clamav.user Sent: Wednesday, May 05, 2004 4:17 PM Subject: Re: Worm/virus not recognized locally > On Wednesday 05 May 2004 3:09 pm, Flynn wrote: > > > Hi everyone ... > > > > I have a file, which I suppose is infected with W32/[EMAIL PROTECTED], if I trust > > some other AV. > > If I submit it to the clam on-line scan server, it finds it as > > "Worm.SomeFool.Gen-1" > > > > but... clamscan does not find it. > > > > Inside the file there is some .scr attachement, > > If you extract this attachment to a file on its own (without any email headers > or Mime encoding etc) does clamscan identify it then? > > Regards, > > Antony > > -- > All matter in the Universe can be placed into one of two categories: > > 1. Things which need to be fixed. > 2. Things which need to be fixed once you've had a few minutes to play with > them. > > Please reply to the list; > please don't CC me. > > > > ------------------------------------------------------- > This SF.Net email is sponsored by: Oracle 10g > Get certified on the hottest thing ever to hit the market... Oracle 10g. > Take an Oracle 10g class now, and we'll give you the exam FREE. > http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click > _______________________________________________ > Clamav-users mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/clamav-users > ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users ------------------------------------------------------- This SF.Net email is sponsored by Sleepycat Software Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to deliver higher performing products faster, at low TCO. http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
