On Sun, 2004-10-17 at 22:49, James Lick wrote: > (Regarding clam.exe not being detected as an attachment.) > > Someone reported this same problem a few days ago to me as a possible > clamassassin bug. I was able to verify the problem with an attachment > created with Mozilla 1.7.3 which was passed as "OK" by ClamAV. > extracting the attachment to a file and scanning the clam.exe file and > it is detected correctly, so the file didn't get corrupted along the > line somewhere. I hadn't looked into it enough to report the bug yet, > but something is definitely wrong in detecting clam.exe as an attachment.
That is the exact issue I am seeing (even to the clamassassin, but I've ruled that out as being the problem). I thought perhaps there was an issue with how evolution was attaching the file, so I tried outlookE, Mozilla, and pine, all with the same results. A hex dump of the temporary file that clamav created shows that there is a difference between it and the original. In addition the file sizes are off by one byte, 545 versus the original 544. ----- [EMAIL PROTECTED] tmp]# hexdump clamexerKsqPN >clamexe.mail [EMAIL PROTECTED] tmp]# hexdump clam.exe > clamexe [EMAIL PROTECTED] tmp]# diff -Naur clamexe clamexe.mail --- clamexe 2004-10-18 11:07:47.993537065 -0500 +++ clamexe.mail 2004-10-18 11:07:37.026031258 -0500 @@ -28,4 +28,5 @@ 00001f0 0000 0000 0000 0000 435b 414c 414d 5d56 0000200 1000 0000 1000 0000 0200 0000 0001 0000 0000210 0000 0000 0000 0000 0000 0000 0000 c000 -0000220 +0000220 0000 +0000221 ----- Somewhere a trailing nil (or is it NULL?) byte is being appended. Again, Thank you for taking the time to read this. Robert Haas _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
