Hello Barry2, On Sunday, October 27, 2002 at 8:32:52 PM you [B] wrote (at least in part):
PP>> This re-assembling is done _after_ mails are received, as I could see PP>> at the flicker in my message list, but there's no known hook to me in PP>> The Bat! that gives the message to an AV-plugin when message list PP>> actions are done; the only hook there is at attachment actions like PP>> 'save' or 'open'. B> AIUI - TB! uses temp files to bring in mail and that's where the AV B> would pick up the virus definition ( providing you have it set to scan B> all file types ). CMIIW, but these .tmp fiels are used on 'per message basis' when fetching them from POP/IMAP. The fragmented message will come in as x messages with x .tmp files, non of them containing the complete virus. So the AV-engine must be very lucky to detect the virus, maybe occasionally this is possible. But in general The Bat! will 'rebuild' the virus _after_ those .tmp files are imported to message base and already deleted, so in case of a 'fragmented message virus attack' there will be no single .tmp file an AV-engine could catch. Nevertheless, The Bat! uses temporarily files as well when opening attachments from inside The Bat!, so first an eventually configured 'Scan attachments when opening' plug in will take effect and second an eventually installed and configured resident virus shield will recognize the virus if the plugin is missing / not activated. -- Regards Peter Palmreuther (The Bat! v1.62/Beta7 on Windows 2000 5.0 Build 2195 Service Pack 1) Bureaucrat, n.: A politician who has tenure. ________________________________________________ Current version is 1.61 | "Using TBUDL" information: http://www.silverstones.com/thebat/TBUDLInfo.html
