On Tue, 8 Jan 2008 20:46:06 +0100 Tomasz Kojm <[EMAIL PROTECTED]> wrote:
> On Tue, 8 Jan 2008 17:31:44 +0000 (GMT Standard Time) > Phil Chambers <[EMAIL PROTECTED]> wrote: > > > I have the two messages on disc and scanned them manually using clamdscan > > on the command line. In this situation my MTA and SMTP are not involved. > > clamdscan finds the signature in one file but it does not find it in the > > other file. Both files contain the signature and differ only in the > > header. The signature is in the message bod, not the header. > > Hi Phil, > > if possible, please send me the files (inside a password encrypted zip) and > I'll have a look. > > Thanks, This is getting too confusing! Yesterday when I ran clamdsacn on the two files one was reported as clean and the other as containing Email.Spam.Sanesecurity. Url_557. I also had 12 other pairs of files showing the same problem with a variety of signatures. This morning there is no difference! clamdscan is finding the signatures in all the files. What has changed is that the signature files have been updated. However, the signature for Email.Spam.Sanesecurity.Url_557 is identical to what it was yesterday. I can see from the logs that basic problem is still occurring, so I will have to start from scratch again to capture fresh examples. My problem is that I have to work with my live service, so there is a limit to what I can do. I will get back to you when I have new examples. I will also have to think about setting a parallel system up on a test server which does not have the signatures updated. Phil. --------------------------------------- Phil Chambers ([EMAIL PROTECTED]) University of Exeter _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
