I've just tried it and got this: [EMAIL PROTECTED] njh]$ clamscan --mbox 1088626977.9122.webmail.txt 1088626977.9122.webmail.txt: Worm.Zafi.B FOUND
----------- SCAN SUMMARY ----------- Known viruses: 22228 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.01 MB I/O buffer size: 131072 bytes Time: 0.563 sec (0 m 0 s) [EMAIL PROTECTED] test]$ clamdscan 1088626977.9122.webmail.txt /home/njh/src/njh/mime/test/1088626977.9122.webmail.txt: Worm.Zafi.B FOUND ----------- SCAN SUMMARY ----------- Infected files: 1 Time: 0.043 sec (0 m 0 s) [EMAIL PROTECTED] test]$ Do you have ScanMail defined in your clamav.conf? -Nigel On Wednesday 30 Jun 2004 23:36, Jeff Masud wrote: > Hello, > > > > I've been using clamdscan with qmail-scanner for quite some time now. > Recently we have noticed a couple of attachments which were xxx.gif.pif were > allowed through the scanning system, by doing some testing, we were able to > determine this was because the attachment was binhex encoded. > > > > Here's an example email that the *.pif which it didn't catch. > > > > clamscan / ClamAV version 0.74 > > > > Known viruses: 22220 > > > > bash-2.05a$ clamdscan 1088626977.9122.webmail,S\=20149\:2, > > /home/vpopmail/domains/sudjam.com/jeff/Maildir/cur/1088626977.9122.webmail,S > =20149:2,: OK > > > > ----------- SCAN SUMMARY ----------- > > Infected files: 0 > > Time: 0.008 sec (0 m 0 s) > > bash-2.05a$ > > > > http://pobox.thezit.com/~jmasud/virusexample/1088626977.9122.webmail.txt > > > > I know clamav will catch it if I upload just the attachment to the scanner > test site, or if I email it back to myself using base64 encoding it gets > caught. I've searched the archives for binhex and found nothing that would > help, besides from the docs and change log it appears binhex has been > implemented just not sure why it's not working for me. > > > > Can someone suggest what I should or could do to resolve this? > > > > Thanks > > Jeff > > > > > > -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
