I found an already older virusmail (February this year) which was
recognised by inocucmd
and tried to feed it to clamav (0.75. main.cvd 24, daily.cvd 423). It
didn't recognise it (I used the --mbox option).
However when I tried to submit it, the page came back saying that it
already is recognised.
Here's the output of inocucmd (running on my old SuSE 7 system, clamav
not installed)
# /usr/local/av/inocucmd -NEX virus-20030403-121256-27560
----------./virus-20030403-121256-27560
[./virus-20030403-121256-27560:BlueMountaineCard.pif] was infected by
virus [Backdoor/SDBot.Server.Variant]
Total Files Scanned: 2
Total Bytes Scanned: 22189
Total Viruses Found: 1
Total Infected Files Found: 1
Scan Type: Fast
*** End Of Summary ***
And here's the result of clamav 0.75:
# clamscan --mbox virus-20030403-121256-27560
virus-20030403-121256-27560: OK
----------- SCAN SUMMARY -----------
Known viruses: 22927
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.05 MB
I/O buffer size: 131072 bytes
Time: 0.677 sec (0 m 0 s)
What's going on here?
Thanks,
Albert
P.S. I managed to create a single .cvd file for it. It works (in clamscan) but it looks like it doesn't work in clamav-milter.
