Török Edwin wrote: > On 2008-09-01 15:57, Benoit Schmid wrote: >> Good morning, >> >> I have set a filter with "application/zip; name=testxxx.zip". >> I have a file/email with the following line in it: >> ... >> --Boundary_(ID_4GBDup7bX3Z1tEB0xZDRDQ) >> Content-type: application/zip; name=testxxx.zip >> ... >> >> If I connect to the clamd server and issue the command >> SCAN email_with_pattern, then it is detected correctly by clamd. >> >> If I connect to clamd and issue a STREAM, then I provide >> the content email_with_pattern to the child clamd process. >> Unfortunately, this time, clamd does not detect the "virus". >> It says OK after the analysis. >> >> Would you know why there is this difference in the behavior >> of clamd. >> >> How could I make this application/zip; name=testxxx.zip >> be detected by clamd? >> >> Thanks in advance for your answers. >> > > Hi, > > Can you reproduce this problem with clamdscan? > Does the following show different output? > $ clamdscan yourfile > $ clamdscan - <yourfile >
No, both clamdscan find it as infected. > Please open a bugreport on bugs.clamav.net, and attach the sample file > (it will be marked as private automatically). > Ok, I will do it. > Best regards, > --Edwin > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
