Sorry, I missed the attached file.
Thank you very much in advance!
Chinh Nguyen Tam wrote:
Greetings,
We've notice some strange behavior of clamav in our email server for.
When we try to send some email (HTML format, Outlook 2003) with URL
inside, clamav detects these email as Email.Foolball-2 virus. If we send
the emails with the same URL in Thunderbird HTML format or in pure text,
clamav will let the emails pass by.
You can see the example of one Outlook HTML attached in this messages
(please unpack with gzip).
Please advice if anyone met the same problem before and how to solve this.
Thank you very much!
From maillog:
----
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550:
from=<[EMAIL PROTECTED]>, size=3856, class=0, nrcpts=2,
msgid=<00f501c803d2$75465c20$
[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[192.168.11.57]
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550: Milter add:
header: X-Virus-Scanned: ClamAV 0.90.1/4442/Sun Sep 30 19:20:50 2007 on sma
il.xxx.com.vn
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550: Milter add:
header: X-Virus-Status: Infected with Email.Foolball-2
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550: Milter: data,
reject=554 5.7.1 virus Email.Foolball-2 detected by ClamAV - http://www.c
lamav.net
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550:
to=<[EMAIL PROTECTED]>, delay=00:00:00, pri=63856, stat=virus
Email.Foolball-2 detecte
d by ClamAV - http://www.clamav.net
Oct 1 09:28:39 smail sendmail[31550]: l912Sd0V031550:
to=<[EMAIL PROTECTED]>, delay=00:00:00, pri=63856, stat=virus
Email.Foolball-2 detected b
y ClamAV - http://www.clamav.net
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
