ClamAV version : clamscan / ClamAV version devel-20040203
OS : FreeBSD 4.9-STABLE #35: Wed Jan 28
It seems clamscan is having trouble finding SCO.a in a multiply-attached
file.
I have the following files:
vir1 : multiply-attached message with SCO.a
vir1.sco-attachment : the mmencoded "readme.zip" attachment from vir1
vir1.readme.zip : the decoded readme.zip
vir2 : another file with SCO.a attached
When I run
clamscan --mbox .
I get this:
./vir1: OK
./vir1.sco-attachment: OK
./vir1.readme.zip: Worm.SCO.A FOUND
./vir2: Worm.SCO.A FOUND
So, once I decode the readme.zip by hand, SCO.a is found, otherwise it
isn't.
The files can be found here
http://www.cise.ufl.edu/~jfh/sco-examples
Thanks,
----------------------------------------------------------------------
| Jim Hranicky, Senior SysAdmin UF/CISE Department |
| E314D CSE Building Phone (352) 392-1499 |
| [EMAIL PROTECTED] http://www.cise.ufl.edu/~jfh |
----------------------------------------------------------------------
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
