Tris Forster wrote:

Hi

Clam should be detecting Netsky.P as Somefool.P (crazy virus alias
stuff).  The definition has been in the db for months so it looks like
you have a configuration issue.  Is the infected file buried in a zip or
similar?

Tris

On Sun, 2004-06-13 at 10:10, Arthur Kerpician wrote:


Hi all,
I've been using for quite a while Clamav on a qmail smarthost which delivers mail to a local exchange server. Before using Clamav, the exchange server was protected by NAV for Exchange and I left it working just for backup scanning.
From time to time (once on every 3-4 days) NAV gives a warning about a virus [EMAIL PROTECTED] which was found in a received mail. The mail headers shows that it passed through the qmail server and was scanned by qmailscanner/clamav.
Is that a false alarm? I really want to give up for good NAV but i feel a little unsecure getting those messages...


Thanks,
Arthur



-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the
one installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users


It detects W32.Netsky.P as SomeFool.P, no problem there. NAV is complaining about another version ([EMAIL PROTECTED]) and according to Symantec:
"When a file is detected as [EMAIL PROTECTED], this indicates that it is a MIME-encoded file containing the [EMAIL PROTECTED] <http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED]> worm. For additional information, read the document, "What is an .enc detection? <http://securityresponse.symantec.com/avcenter/venc/data/enc.detection.html>" and the [EMAIL PROTECTED] <http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED]> writeup."


This is an extract from http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED]



-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users

Reply via email to