A.R.S. KA9QLQ Alvin Koffman wrote:

I ran this from a terminal and got

[EMAIL PROTECTED] /]# clamscan -ri /home
/home/ka9qlq/.thunderbird/default/9x8zs2cf.slt/Mail/pop.sbcglobal.yahoo.com/Inbox: Exploit.IFrame.Gen FOUND
/home/ka9qlq/evolution/local/Inbox/mbox: Worm.Bagle.H-zippwd-1 FOUND
/home/ka9qlq/.Mail/trash/26: Worm.Bagle.H-zippwd-1 FOUND


----------- SCAN SUMMARY -----------
Known viruses: 22853
Scanned directories: 1442
Scanned files: 9437
Infected files: 3
Data scanned: 5827.12 MB
I/O buffer size: 131072 bytes
Time: 11574.769 sec (192 m 54 s)

How do I tell whitch email they are? Can clam take out the infected emails with out messing up my inbox?

For the Trash, just empty the Trash, easy he.

A long time ago, for a completely different problem,
I wrote this little prog to split up a netscape mailbox
into separate files names F00000, F00001, F00002,...


########################################## #!/usr/bin/perl -p

BEGIN {
        $i = "00000" unless $i;
        open(STDOUT, ">F$i");
}

if (/^From /) { # Unix/netscape mailbox
        ++$i;
        open(STDOUT, ">F$i");
        $_ = ""  if m/^\.\r?$/;
}
##########################################"


Split it up, scan each file, remove the virusses, concatenate again, remove index file, and open again with mozilla (or thunderbird).

On the other side, you do not get infected using Mozilla/thunderbird
when you simply look at the mail (contrary to M$Lookout).
With a little experience, you can recognize such virusses
when just looking at them (attachment around 30-69Kbytes,
exe-type or zip with a known list of types, subject, and or
message body only one or two lines ("hi", "important" etc.).
Then delete just delete them.


Thanks
Alvin


------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users



--
Paul Bijnens, Xplanation                            Tel  +32 16 397.511
Technologielaan 21 bus 2, B-3001 Leuven, BELGIUM    Fax  +32 16 397.512
http://www.xplanation.com/          email:  [EMAIL PROTECTED]
***********************************************************************
* I think I've got the hang of it now:  exit, ^D, ^C, ^\, ^Z, ^Q, F6, *
* quit,  ZZ, :q, :q!,  M-Z, ^X^C,  logoff, logout, close, bye,  /bye, *
* stop, end, F3, ~., ^]c, +++ ATH, disconnect, halt,  abort,  hangup, *
* PF4, F20, ^X^X, :D::D, KJOB, F14-f-e, F8-e,  kill -1 $$,  shutdown, *
* kill -9 1,  Alt-F4,  Ctrl-Alt-Del,  AltGr-NumLock,  Stop-A,  ...    *
* ...  "Are you sure?"  ...   YES   ...   Phew ...   I'm out          *
***********************************************************************




------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users

Reply via email to