On 2008-09-01 15:57, Benoit Schmid wrote: > Good morning, > > I have set a filter with "application/zip; name=testxxx.zip". > I have a file/email with the following line in it: > ... > --Boundary_(ID_4GBDup7bX3Z1tEB0xZDRDQ) > Content-type: application/zip; name=testxxx.zip > ... > > If I connect to the clamd server and issue the command > SCAN email_with_pattern, then it is detected correctly by clamd. > > If I connect to clamd and issue a STREAM, then I provide > the content email_with_pattern to the child clamd process. > Unfortunately, this time, clamd does not detect the "virus". > It says OK after the analysis. > > Would you know why there is this difference in the behavior > of clamd. > > How could I make this application/zip; name=testxxx.zip > be detected by clamd? > > Thanks in advance for your answers. >
Hi, Can you reproduce this problem with clamdscan? Does the following show different output? $ clamdscan yourfile $ clamdscan - <yourfile Please open a bugreport on bugs.clamav.net, and attach the sample file (it will be marked as private automatically). Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
