Hi, We're running Postfix+Amavisd-new +Clamav+Spamassassin for email content filtering. I created my own signatures for two frequent gif images that contain spam. I put these in gifs.db, which I put in the same place as the main clamav databases. When I run clamscan or clamdscan against an email containing the image, it detects the signature in the file. When I send the file via email to another recipient, amavis (using clamav to scan mail) reports the email as clean. If I then scan the delivered message in the IMAP folder it was delivered to using clamscan/clamdscan, it is again detected as the signature. I'm baffled by this, as it does not make sense to me. I've restarted clamd and amavisd, without any luck.
clamav 0.85.1 amavisd-new 2.1.1 I've added details below. I would appreciate any ideas. Regards, Nicki My custom signatures: Spam.OEMGif.A (Clam)=33627a3744345a4e526e3652614a7a6f69717151786c7075544e667350462b357a666549752f5039594d4b695559456a76704971 307536554753356669644c426d6f6f36 Spam.ViagraGif.A (Clam)=443361435949776c755a696874713354694c71516172587966644575444f4f4f436f776c64417a694957417a494a564a6e384 c6f48416f6c7943707279616871 clamscan output: bsd-ns2# clamscan img img: Spam.ViagraGif.A FOUND clamdscan output: bsd-ns2# clamdscan img /home/nicki/img: Spam.ViagraGif.A FOUND ----------- SCAN SUMMARY ----------- Infected files: 1 Time: 0.024 sec (0 m 0 s) bsd-ns2# ----------- SCAN SUMMARY ----------- Known viruses: 35701 Engine version: 0.85.1 Scanned directories: 0 Scanned files: 1 Infected files: 1 Data scanned: 0.00 MB Time: 1.751 sec (0 m 1 s) bsd-ns2# Nicki de Wet Application Integration Solutions GijimaAst Tel: +27 (0)21 680 3300
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
