On Tue, 23 Sep 2003 at 8:35:57 +0200, Thomas Lamy wrote: > Philip Mak wrote: > >On Tue, Sep 23, 2003 at 12:34:41AM -0400, Flinn Mueller wrote: > >>On Tuesday, September 23, 2003, at 12:13 AM, Philip Mak wrote: > >>>When I scan a MIME message using ClamAV, can I just feed the raw > >>>message into ClamAV, or do I have to use ripmime first to extract the > >>>individual attachments into files first? > >> > >>No you don't have to use ripmime. > > > >Actually, I just found a message where if I clamscan the whole > >message, it claims the message is clean, but if I save the attachment > >file and clamscan that, it finds a virus. > > > >So I'm guessing ripmime is needed. > > > No. clam has it's own de-MIMe code. You have to use the --mbox option in > clamscan, or enable the ScanMail switch in your clamav.conf for clamd.
Option --mbox isn't perfect yet. Better "de-MIME" a message _first_. Really. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
