[EMAIL PROTECTED] wrote: > On Dec 23, 2005, at 12:00 , Jeff Donsbach wrote: > >> On 12/23/05, Dale Walsh <[EMAIL PROTECTED]> wrote: >>> >>> Please elaborate because as the subject states "virus detected using >>> clamscan but not with Mail::ClamAV perl module". leads one to >>> believe that the thread is about failure to detect virii with >>> software. >>> >> >> [sorry about that last messge... fat fingers...] >> >> Dale, >> >> Perhaps a little more background information about what is on those >> pages to go along with the URLs you posted in your first post would >> have helped avoid this whole misunderstanding. My first reaction at >> seeing that first post of yours was that I thought it was a phishing >> attempt or commecial spam of some kind (and I skipped over it). > > Yes, I see your point, the gist was that scanning a buffer > doesn't catch most virii and the first link is the results of > the scans which occur at the time the link is accessed. > > There also seems to be a conflict of the actual virus name > that is detected between a buffer scan and a disk file scan. > > The settings configured to scan either are the same so I'm at > a loss for the failures and discrepancies. > > Of course it's free software with no guarantee that it will > work as intended or work in a particular environment so if it > gets looked at great, if not that's OK too, I can accept that > scanning a buffer is unreliable and not use this option.
I don't understand all the technicalities, but is this the reason why clamscan and the online scanner do not catch some Sober.Y variants, but clamdscan does (actually, I have one email where is doesn't find it either :-( )? I also notice that clamscan can scan and detect some Phising mails very fast, while clamdscan seems to hang on them (for about 30 seconds). Is that related? Kind regards, Sander Holthaus _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
