On Tue, 16 Jan 2007 08:15:41 +0300 Odhiambo Washington <[EMAIL PROTECTED]> wrote:
> * On 15/01/07 21:12 -0800, Dennis Peterson wrote: > | Odhiambo Washington wrote: > | >Hi, > | > > | >For some strange reasons, I've seen some malware go past my filters > | >on several occasions. > | >One such case is today, where a mail containing two attachments, one > | >a gif and the other a zip archive, skipped clamd completely and was > | >delivered to my inbox. > | > > | >However, when I extract the attachment from the file and scan it with > | >clamd, the worm is detected. > | > > | >Either this is a failure of the configuration on my MTA, or in the > | >way clamd analyzes such e-mail. I am running 0.88.7. > | > | Do you have any kind of minimum size limit a message must have before it > | is a candidate for scanning? Many sites don't scan very large messages > | because they are outside the typical size for spam/viruses. It's a > | choice that brings some risk but it does make things more efficient. > > Yes, I don't subject to scanning any mails whose size exceed 1MB, but > the mail in question does not meet this criteria. > > > -Wash > > http://www.netmeister.org/news/learn2quote.html > > DISCLAIMER: See http://www.wananchi.com/bms/terms.php > > -- > +======================================================================+ > |\ _,,,---,,_ | Odhiambo Washington <[EMAIL PROTECTED]> > Zzz /,`.-'`' -. ;-;;,_ | Wananchi Online Ltd. www.wananchi.com > |,4- ) )-,_. ,\ ( `'-'| Tel: +254 20 313985-9 +254 20 313922 > '---''(_/--' `-'\_) | GSM: +254 722 743223 +254 733 744121 > +======================================================================+ > > New members urgently required for SUICIDE CLUB, Watford area. > -- Monty Python's Big Red Book > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://lurker.clamav.net/list/clamav-users.html Don't forget that mails are delivered in base 64 (usually??) if they're binary, and this could exceed the 1MB threshold if they're of any size, as they're a lot bigger than the final target.. Steve _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
