> Date: Fri, 18 Mar 2005 16:31:52 +0100
> From: Tomasz Kojm <[EMAIL PROTECTED]>
[...snip...]
> > In short: 1) virus attachment IS NOT identified when the jpeg
> > attachment
> > is present
> > 2) virus attachment IS identified if same mail w/o jpeg is
> > scanned
>
> It's not a bug in ClamAV but rather in your wrapper between an SMTP
> daemon and the scanner.
The mail file is scanned with clamscan directly from command prompt, and
not through any kind of SMTP-related programs.
The mail in this case consists of three attachments:
1) text/html
2) image/jpeg
3) application/octet-stream
When the mail file is scanned WITH the jpeg, only attachments 1 and 2 are
found (see debug output in my previous post).
After removing the jpeg attachment, the mail file is scanned again and now
the final attachment is found, scanned and the virus is identified.
Attachment structure (contents removed) :
----------mktekjuonfbmlaqzwhlr
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
----------mktekjuonfbmlaqzwhlr
Content-Type: image/jpeg; name="me2.jpeg"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="me2.jpeg"
Content-ID: <me2.jpeg>
----------mktekjuonfbmlaqzwhlr
Content-Type: application/octet-stream; name="Readme"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Readme"
----------mktekjuonfbmlaqzwhlr--
(the name and filename of the last attachment is actually readme.cpl, but
I have changed these to avoid buggy email scanning software some readers
of this list probably use)
This _IS_ related to the bad jpeg. If I replace the jpeg attachment with
another (good jpeg), all three attachments are identified and the virus
is found.
Included in this post are debug output of clamscan scanning the same mail
twice; one with a bad jpeg, one with a good jpeg.
//D
LibClamAV debug: Loading databases from /usr/local/share/clamav
LibClamAV debug: Loading /usr/local/share/clamav/main.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = 486d65d0e35f87e7bca148052cdc6e67
LibClamAV debug: Decoded signature: 486d65d0e35f87e7bca148052cdc6e67
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-5cbdd47c8f2acdde/COPYING
LibClamAV debug: Unpacking /tmp/clamav-5cbdd47c8f2acdde/main.db
LibClamAV debug: Unpacking /tmp/clamav-5cbdd47c8f2acdde/main.hdb
LibClamAV debug: Unpacking /tmp/clamav-5cbdd47c8f2acdde/main.ndb
LibClamAV debug: Loading databases from /tmp/clamav-5cbdd47c8f2acdde
LibClamAV debug: Loading /tmp/clamav-5cbdd47c8f2acdde/main.db
LibClamAV debug: Initializing main node
LibClamAV debug: Initializing trie
LibClamAV debug: Initializing BM tables
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Loading /tmp/clamav-5cbdd47c8f2acdde/main.hdb
LibClamAV debug: Initializing md5 list structure
LibClamAV debug: Loading /tmp/clamav-5cbdd47c8f2acdde/main.ndb
LibClamAV debug: Loading /usr/local/share/clamav/daily.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = 29fda05728608a6bd19ef557e0f7efca
LibClamAV debug: Decoded signature: 29fda05728608a6bd19ef557e0f7efca
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-bdce98d54a6787c3/COPYING
LibClamAV debug: Unpacking /tmp/clamav-bdce98d54a6787c3/daily.db
LibClamAV debug: Unpacking /tmp/clamav-bdce98d54a6787c3/daily.hdb
LibClamAV debug: Unpacking /tmp/clamav-bdce98d54a6787c3/daily.ndb
LibClamAV debug: Unpacking /tmp/clamav-bdce98d54a6787c3/daily.zmd
LibClamAV debug: Loading databases from /tmp/clamav-bdce98d54a6787c3
LibClamAV debug: Loading /tmp/clamav-bdce98d54a6787c3/daily.db
LibClamAV debug: Loading /tmp/clamav-bdce98d54a6787c3/daily.hdb
LibClamAV debug: Loading /tmp/clamav-bdce98d54a6787c3/daily.ndb
LibClamAV debug: Recognized Raw mail file
LibClamAV debug: Starting cli_scanmail(), mrec == 1, arec == 0
LibClamAV debug: in mbox()
LibClamAV debug: parseEmailFile
LibClamAV debug: parseEmailFile: check 'Received: from [1.2.3.4] by banana
(Virus SMTP 2.0)' contMarker 0
LibClamAV debug: parseEmailFile: check ' with SMTP id 25635423; Tue Oct
05 04:48 PDT 2004' contMarker 0
LibClamAV debug: parseEmailFile: check 'Date: Tue, 05 Oct 2004 07:42:55 -0500'
contMarker 0
LibClamAV debug: parseEmailFile: check 'To: [EMAIL PROTECTED]' contMarker 0
LibClamAV debug: parseEmailFile: check 'Subject: Hello!' contMarker 0
LibClamAV debug: parseEmailFile: check 'From: [EMAIL PROTECTED]' contMarker 0
LibClamAV debug: parseEmailFile: check 'Message-Id: <[EMAIL PROTECTED]>'
contMarker 0
LibClamAV debug: parseEmailFile: check 'Mime-Version: 1.0' contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Type: multipart/mixed;'
contMarker 0
LibClamAV debug: parseEmailFile: check '
boundary="--------mktekjuonfbmlaqzwhlr"' contMarker 1
LibClamAV debug: parseEmailFile: check ' ' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Type: multipart/mixed;
boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: parseMimeHeader: cmd='Content-Type', arg=' multipart/mixed;
boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: messageSetMimeType: 'multipart'
LibClamAV debug: mimeArgs = ' boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: Add arguments ' boundary="--------mktekjuonfbmlaqzwhlr"
'
LibClamAV debug: parseEmailFile: check '----------mktekjuonfbmlaqzwhlr'
contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Type: text/html;
charset="us-ascii"' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Type: text/html; charset="us-ascii"'
LibClamAV debug: parseMimeHeader: cmd='Content-Type', arg=' text/html;
charset="us-ascii"'
LibClamAV debug: messageSetMimeType: 'text'
LibClamAV debug: mimeArgs = ' charset="us-ascii"'
LibClamAV debug: Add arguments ' charset="us-ascii"'
LibClamAV debug: Discarding unwanted argument 'charset'
LibClamAV debug: parseEmailFile: check 'Content-Transfer-Encoding: 7bit'
contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Transfer-Encoding: 7bit'
LibClamAV debug: parseMimeHeader: cmd='Content-Transfer-Encoding', arg=' 7bit'
LibClamAV debug: messageSetEncoding: '7bit'
LibClamAV debug: Encoding type 1 is "7bit"
LibClamAV debug: parseEmailFile: check '' contMarker 0
LibClamAV debug: End of header information
LibClamAV debug: parseEmailFile: return
LibClamAV debug: in parseEmailBody
LibClamAV debug: Parsing mail file
LibClamAV debug: mimeType = 6
LibClamAV debug: 0 multiparts found
LibClamAV debug: Not found uuencoded file
LibClamAV debug: Found a bounce message with no header
LibClamAV debug: blobSetFilename: bounce
LibClamAV debug: fileblobSetFilename:
mkstemp(/tmp/clamav-098d98600d4d0f5f/bounceXXXXXX)
LibClamAV debug: Saving attachment as /tmp/clamav-098d98600d4d0f5f/bounce8brAK6
LibClamAV debug: parseEmailBody() returning 1
LibClamAV debug: cli_mbox returning 0
LibClamAV debug: Recognized Raw mail file
LibClamAV debug: Starting cli_scanmail(), mrec == 2, arec == 0
LibClamAV debug: in mbox()
LibClamAV debug: parseEmailFile
LibClamAV debug: parseEmailFile: check 'Received: by clamd (bounce)' contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Transfer-Encoding: base64'
contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Transfer-Encoding: base64'
LibClamAV debug: parseMimeHeader: cmd='Content-Transfer-Encoding', arg=' base64'
LibClamAV debug: messageSetEncoding: 'base64'
LibClamAV debug: Encoding type 1 is "base64"
LibClamAV debug: parseEmailFile: check 'Content-Disposition: attachment;
filename="me2.jpeg"' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Disposition: attachment;
filename="me2.jpeg"'
LibClamAV debug: parseMimeHeader: cmd='Content-Disposition', arg=' attachment;
filename="me2.jpeg"'
LibClamAV debug: Force mime encoding to application
LibClamAV debug: messageSetMimeType: 'application'
LibClamAV debug: parseEmailFile: check 'Content-ID: <me2.jpeg>' contMarker 0
LibClamAV debug: parseEmailFile: check '' contMarker 0
LibClamAV debug: End of header information
LibClamAV debug: parseEmailFile: return
LibClamAV debug: in parseEmailBody
LibClamAV debug: Parsing mail file
LibClamAV debug: mimeType = 1
LibClamAV debug: messageToFileblob
LibClamAV debug: messageExport: numberOfEncTypes == 1
LibClamAV debug: messageExport: enctype 0 is 2
LibClamAV debug: blobSetFilename: me2.jpeg
LibClamAV debug: fileblobSetFilename:
mkstemp(/tmp/clamav-db6346f4e514a59a/me2.jpegXXXXXX)
LibClamAV debug: Saving attachment as
/tmp/clamav-db6346f4e514a59a/me2.jpegCszAt1
LibClamAV debug: Exported 63981 bytes using enctype 2
LibClamAV debug: 2 trailing bytes to export
LibClamAV debug: base64chars = 2 (+ ? @)
LibClamAV debug: Saving main message as attachment
LibClamAV debug: 0 multiparts found
LibClamAV debug: Not found uuencoded file
LibClamAV debug: Saving text part to scan
LibClamAV debug: Force mime encoding to application
LibClamAV debug: messageSetMimeType: 'application'
LibClamAV debug: messageToFileblob
LibClamAV debug: parseEmailBody() returning 1
LibClamAV debug: cli_mbox returning 0
LibClamAV debug: Recognized JPEG file
LibClamAV debug: Worm.Bagle.AC found in descriptor 7.
LibClamAV debug: Loading databases from /usr/local/share/clamav
LibClamAV debug: Loading /usr/local/share/clamav/main.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = 486d65d0e35f87e7bca148052cdc6e67
LibClamAV debug: Decoded signature: 486d65d0e35f87e7bca148052cdc6e67
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-f0dd30ce048dab9f/COPYING
LibClamAV debug: Unpacking /tmp/clamav-f0dd30ce048dab9f/main.db
LibClamAV debug: Unpacking /tmp/clamav-f0dd30ce048dab9f/main.hdb
LibClamAV debug: Unpacking /tmp/clamav-f0dd30ce048dab9f/main.ndb
LibClamAV debug: Loading databases from /tmp/clamav-f0dd30ce048dab9f
LibClamAV debug: Loading /tmp/clamav-f0dd30ce048dab9f/main.db
LibClamAV debug: Initializing main node
LibClamAV debug: Initializing trie
LibClamAV debug: Initializing BM tables
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Loading /tmp/clamav-f0dd30ce048dab9f/main.hdb
LibClamAV debug: Initializing md5 list structure
LibClamAV debug: Loading /tmp/clamav-f0dd30ce048dab9f/main.ndb
LibClamAV debug: Loading /usr/local/share/clamav/daily.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = 29fda05728608a6bd19ef557e0f7efca
LibClamAV debug: Decoded signature: 29fda05728608a6bd19ef557e0f7efca
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-5d49a794b0db24d0/COPYING
LibClamAV debug: Unpacking /tmp/clamav-5d49a794b0db24d0/daily.db
LibClamAV debug: Unpacking /tmp/clamav-5d49a794b0db24d0/daily.hdb
LibClamAV debug: Unpacking /tmp/clamav-5d49a794b0db24d0/daily.ndb
LibClamAV debug: Unpacking /tmp/clamav-5d49a794b0db24d0/daily.zmd
LibClamAV debug: Loading databases from /tmp/clamav-5d49a794b0db24d0
LibClamAV debug: Loading /tmp/clamav-5d49a794b0db24d0/daily.db
LibClamAV debug: Loading /tmp/clamav-5d49a794b0db24d0/daily.hdb
LibClamAV debug: Loading /tmp/clamav-5d49a794b0db24d0/daily.ndb
LibClamAV debug: Recognized Raw mail file
LibClamAV debug: Starting cli_scanmail(), mrec == 1, arec == 0
LibClamAV debug: in mbox()
LibClamAV debug: parseEmailFile
LibClamAV debug: parseEmailFile: check 'Received: from [1.2.3.4] by banana
(Virus SMTP 2.0)' contMarker 0
LibClamAV debug: parseEmailFile: check ' with SMTP id 25635423; Tue Oct
05 04:48 PDT 2004' contMarker 0
LibClamAV debug: parseEmailFile: check 'Date: Tue, 05 Oct 2004 07:42:55 -0500'
contMarker 0
LibClamAV debug: parseEmailFile: check 'To: [EMAIL PROTECTED]' contMarker 0
LibClamAV debug: parseEmailFile: check 'Subject: Hello!' contMarker 0
LibClamAV debug: parseEmailFile: check 'From: [EMAIL PROTECTED]' contMarker 0
LibClamAV debug: parseEmailFile: check 'Message-Id: <[EMAIL PROTECTED]>'
contMarker 0
LibClamAV debug: parseEmailFile: check 'Mime-Version: 1.0' contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Type: multipart/mixed;'
contMarker 0
LibClamAV debug: parseEmailFile: check '
boundary="--------mktekjuonfbmlaqzwhlr"' contMarker 1
LibClamAV debug: parseEmailFile: check ' ' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Type: multipart/mixed;
boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: parseMimeHeader: cmd='Content-Type', arg=' multipart/mixed;
boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: messageSetMimeType: 'multipart'
LibClamAV debug: mimeArgs = ' boundary="--------mktekjuonfbmlaqzwhlr" '
LibClamAV debug: Add arguments ' boundary="--------mktekjuonfbmlaqzwhlr"
'
LibClamAV debug: parseEmailFile: check '----------mktekjuonfbmlaqzwhlr'
contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Type: text/html;
charset="us-ascii"' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Type: text/html; charset="us-ascii"'
LibClamAV debug: parseMimeHeader: cmd='Content-Type', arg=' text/html;
charset="us-ascii"'
LibClamAV debug: messageSetMimeType: 'text'
LibClamAV debug: mimeArgs = ' charset="us-ascii"'
LibClamAV debug: Add arguments ' charset="us-ascii"'
LibClamAV debug: Discarding unwanted argument 'charset'
LibClamAV debug: parseEmailFile: check 'Content-Transfer-Encoding: 7bit'
contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Transfer-Encoding: 7bit'
LibClamAV debug: parseMimeHeader: cmd='Content-Transfer-Encoding', arg=' 7bit'
LibClamAV debug: messageSetEncoding: '7bit'
LibClamAV debug: Encoding type 1 is "7bit"
LibClamAV debug: parseEmailFile: check '' contMarker 0
LibClamAV debug: End of header information
LibClamAV debug: parseEmailFile: return
LibClamAV debug: in parseEmailBody
LibClamAV debug: Parsing mail file
LibClamAV debug: mimeType = 6
LibClamAV debug: 0 multiparts found
LibClamAV debug: Not found uuencoded file
LibClamAV debug: Found a bounce message with no header
LibClamAV debug: blobSetFilename: bounce
LibClamAV debug: fileblobSetFilename:
mkstemp(/tmp/clamav-a249e42006498890/bounceXXXXXX)
LibClamAV debug: Saving attachment as /tmp/clamav-a249e42006498890/bounceMvpjp3
LibClamAV debug: parseEmailBody() returning 1
LibClamAV debug: cli_mbox returning 0
LibClamAV debug: Recognized Raw mail file
LibClamAV debug: Starting cli_scanmail(), mrec == 2, arec == 0
LibClamAV debug: in mbox()
LibClamAV debug: parseEmailFile
LibClamAV debug: parseEmailFile: check 'Received: by clamd (bounce)' contMarker 0
LibClamAV debug: parseEmailFile: check 'Content-Transfer-Encoding: base64'
contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Transfer-Encoding: base64'
LibClamAV debug: parseMimeHeader: cmd='Content-Transfer-Encoding', arg=' base64'
LibClamAV debug: messageSetEncoding: 'base64'
LibClamAV debug: Encoding type 1 is "base64"
LibClamAV debug: parseEmailFile: check 'Content-Disposition: attachment;
filename="me2.jpeg"' contMarker 0
LibClamAV debug: parseEmailHeader 'Content-Disposition: attachment;
filename="me2.jpeg"'
LibClamAV debug: parseMimeHeader: cmd='Content-Disposition', arg=' attachment;
filename="me2.jpeg"'
LibClamAV debug: Force mime encoding to application
LibClamAV debug: messageSetMimeType: 'application'
LibClamAV debug: parseEmailFile: check 'Content-ID: <me2.jpeg>' contMarker 0
LibClamAV debug: parseEmailFile: check '' contMarker 0
LibClamAV debug: End of header information
LibClamAV debug: parseEmailFile: return
LibClamAV debug: in parseEmailBody
LibClamAV debug: Parsing mail file
LibClamAV debug: mimeType = 1
LibClamAV debug: messageToFileblob
LibClamAV debug: messageExport: numberOfEncTypes == 1
LibClamAV debug: messageExport: enctype 0 is 2
LibClamAV debug: blobSetFilename: me2.jpeg
LibClamAV debug: fileblobSetFilename:
mkstemp(/tmp/clamav-f29a479be1f43f62/me2.jpegXXXXXX)
LibClamAV debug: Saving attachment as
/tmp/clamav-f29a479be1f43f62/me2.jpegWkl50W
LibClamAV debug: Exported 45597 bytes using enctype 2
LibClamAV debug: 1 trailing bytes to export
LibClamAV debug: base64chars = 1 (? @ @)
LibClamAV debug: Saving main message as attachment
LibClamAV debug: 0 multiparts found
LibClamAV debug: Not found uuencoded file
LibClamAV debug: Saving text part to scan
LibClamAV debug: Force mime encoding to application
LibClamAV debug: messageSetMimeType: 'application'
LibClamAV debug: messageToFileblob
LibClamAV debug: parseEmailBody() returning 1
LibClamAV debug: cli_mbox returning 0
LibClamAV debug: Recognized JPEG file
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: in cli_check_jpeg_exploit()
LibClamAV debug: Eliminated false positive match of Exploit.JPEG.Comment
LibClamAV debug: Calculated MD5 checksum: 9c8d6e9fc73551b964a4da30733eb0ee
LibClamAV debug: Calculated MD5 checksum: 5e5085fa8a38559b7866489c22f21159
LibClamAV debug: Calculated MD5 checksum: 69dcbc50c67caee1452809adb335748a
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
