Re: [Clamav-users] clamscan --mbox question

[Thomas Lamy]

Graham Toal wrote:
I want to use clamscan to check mail files (just one mail per file).
These are not in Unix mbox format.  Although they start with mail
headers, the first line is not "From " ...
Viruses are not recognised whether I use plain "clamscan"
or "clamscan --mbox".  They can only be recognised if I edit
a "From " line in to the first line of the file.
The structure of the mail filter is such that I would prefer not
to have to do this.  Is there any way I can scan these files without
adding that line?
Here is a typical header (from an EICAR test):
        X-Originating-Ip: 24.173.85.38
        Message-Id: <[EMAIL PROTECTED]>
        Date: Mon, 12 Jul 2004 22:49:08 -0500
        From: "TESTVIRUS.org" <[EMAIL PROTECTED]>
        To: <[EMAIL PROTECTED]>
        Subject: Virus Scanner Test #1
        Mime-Version: 1.0
        Content-Type: multipart/mixed;
                BounDary="=====================_307115168==_"
        --=====================_307115168==_
        Content-Type: text/plain; charset="us-ascii"; format=flowed
        This message was sent to you because you or someone you know is testing your
        mail server's virus scanner at:  http://www.testvirus.org
        ...
Suggestions?
thanks
Graham
PS Version is "clamscan / ClamAV version devel-20040630"
The solution is to either add "X-Originating-Ip: " to the "magic" items 
in libclamav/mbox.c (or was it scanners.c?), and/or have Nigel Horne 
commit such change in CVS.

Thomas

-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users