On Wed, 24 Nov 2004 at 11:03:56 +0100, Alvaro Uria wrote: > On Wed, 24 Nov 2004 10:17:24 +0100 > Tomasz Papszun <[EMAIL PROTECTED]> wrote: > > > Does ClamAV detect a malware if you change the filename to some > > "normal", short name?... No? Then nothing shows that there is any > > problem with long filenames. > > I see. I changed its filename to message_text.txt.pif and ClamAV didn't > detect it either. > > We're using RedHat Linux. I sent it to a friend who scanned it with > Panda Software on Windows and it detected a virus: W32/Sober.I.worm > (from 11/19/2004) > > I've just updated clamav database (with freshclam -v) but ClamAV still > doesn't detect it :-S > > Thank you very much for your help :-) > > Regards, > Alvaro Urķa. > > PS: Here (http://[censored].e-ghost.net/[censored]/mail.zip) i let you > the virus, if you want to 'play' with it ;-)
Then there's something wrong with your setup. I've just scanned your file (both the original mail.zip and the extracted looooooong_filename, and clamscan have detected the worm: $ clamscan mail.zip message_text.txt\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ .pif mail.zip: Worm.Sober.I FOUND message_text.txt .pif: Worm.Sober.I FOUND ----------- SCAN SUMMARY ----------- Known viruses: 27516 $ clamscan -V ClamAV 0.80/604/Wed Nov 24 00:01:33 2004 -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/iso/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
