For online scan, the result in yesterday was negative but now it can be detected. It is very straightforward, I don't think I make any human mistake.
Thanks,
Jerry Chiu
Christoph Cordes wrote:
On Sunday, May 30, 2004, 4:07:32 AM, Jerry Chiu [Net Workshop] wrote:
JCNW> A email contain Bagle.AB pass thru my Amavisd-New+Clamd filter. The JCNW> lastest clamav(0.71) and db file (333) is installed. I aslo try Clamwin JCNW> and online scanner to scan the attachment file, all have negative JCNW> result. But when I submitt the virus, it said clamav already detect the JCNW> virus. Is there any problem happening?
JCNW> The email file can be downloaded: JCNW> http://www.networkshop.com.hk/~lung/virus/Notification
JCNW> The attachment file can be downloaded: JCNW> http://www.networkshop.com.hk/~lung/virus/Info.scr
JCNW> Thanks,
JCNW> Jerry
First of all: NEVER EVER POST LINKS TO INFECTED FILES TO THE LIST!
I checked your file here and clam detects it without problems. Did you try to scan the file with the --mbox switch?
~/tmp# clamscan mvirus --mbox mvirus: Worm.Bagle.Z FOUND
----------- SCAN SUMMARY ----------- Known viruses: 21755 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.02 MB I/O buffer size: 131072 bytes Time: 0.895 sec (0 m 0 s)
(the mvirus file just contains the mail from the link you posted)
If i remember right, ClamWin can be configured to scan mailfiles too.
-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
