> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Antony > Stone > Sent: Thursday, May 20, 2004 3:23 PM > To: [EMAIL PROTECTED] > Subject: Re: [Clamav-users] Question regarding virus detection > > > On Thursday 20 May 2004 7:21 pm, Peter Bonivart wrote: > > > Jim Maul wrote: > > > There is something that is causing clamav to not be able to > detect this > > > virus after the message has been bounced and now forwarded. > > > > Damaged bounces are not dangerous. Why bother making signatures for them > > when you don't make money showing how many viruses you detect? > > What do you mean by "damaged"? > > It sounds to me as though Jim's email still has a perfectly viable virus > attached to it; it is simply attached in a way that ClamAV isn't > recognising. > > As he said, " If i scan this text file, clamscan 0.70 does not > find any virus. > If I remove the lines below: [snipped here] from the top of the > message, then > clamscan finds Worm.SomeFool.P." >
Exactly, and after some more playing around, i found that i dont even have to remove ALL of those lines. I can leave them all in except the first line which was "-----Original Message-----" If i remove that line, clamscan finds the virus in the message, if i put that line back in the message, clamscan doesnt find the virus. Jim ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
