Hi!
Dennis Peterson wrote:
Is this part of the message in an attachment that is fed to clamav?
dp
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
It is part of the message (which could be in text/plain or text/html)...
[there is a risk that QP or base64 could make it not work I guess (does Clamav takes
care of this?) but the test file I'm using doesn't use either...]
To be sure my signature would match I made an extended signature with a "TargetType"
of "0" (which seems to include the others) and an offset set to "*" *any)
[eg Joke.local.EricssonHoax:0:*:(61|41)(6e|4e)(6e|4e)(61|41)... ]
Thanks!
Nick
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
