Ditto. I thought Declude called the scanner(s) on the d*.smd, plus extracted all the segments out and scanned those too. Is that incorrect?
Also, does Declude recursively unpack MIME segments, if one of the attachments is itself a .eml file or .smd file, would any attachments inside it be unpacked and the scanner(s) called on those? Sorry to ask that second part, as I know I could test that second case, but first I'd have to go and turn off my internal scanner! Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sullivan Sent: Monday, December 20, 2004 1:48 PM To: Declude.Virus@declude.com Subject: Re[8]: [Declude.Virus] testvirus.org #22 >>I turned if off and it still got through. >>Test #17: Eicar virus hidden using the "CR Vulnerability" (attachment >>can be opened by all versions of Microsoft Outlook and Outlook >>Express) RSP> I just checked this one, and it got through here, too. I examined RSP> the raw source of the E-mail, and there doesn't appear to be a lone RSP> CR character in it, so it doesn't appear to actually contain the RSP> Outlook "CR Vulnerability". Scott, what do you get for test #22. Some have reported it caught while others haven't. My F-Prot config is: SCANFILE P:\Progra~1\fsi\f-prot\fpcmd.exe /TYPE /SILENT /NOMEM /ARCHIVE=3 /NOBOOT /DUMB /REPORT=report.txt VIRUSCODE 3 VIRUSCODE 6 VIRUSCODE 8 REPORT Infection: -- Best regards, David mailto:[EMAIL PROTECTED] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
