Re: [Clamav-devel] possible scan evasion

2006-01-17 Thread Nigel Horne
Damian Menscher wrote: I got a virus this morning that made it past clamav-milter 0.87.1. The attachment was double-encoded: after decoding the base64 email, it left a uuencoded file. That file apparently bypassed being scanned because it had a ^M at the end of the line (which violates the s

Re: [Clamav-devel] possible scan evasion

2006-01-17 Thread Andy Fiddaman
On Tue, 17 Jan 2006, Damian Menscher wrote: ; I got a virus this morning that made it past clamav-milter 0.87.1. The ; attachment was double-encoded: after decoding the base64 email, it left a I'm seeing ~6 of these coming in each hour, luckily my other virus scanners are catching it! A. _

[Clamav-devel] possible scan evasion

2006-01-17 Thread Damian Menscher
I got a virus this morning that made it past clamav-milter 0.87.1. The attachment was double-encoded: after decoding the base64 email, it left a uuencoded file. That file apparently bypassed being scanned because it had a ^M at the end of the line (which violates the spec, but don't tell M$ t