Nope, in my testing of three command-line scanners, the attached "test.txt" file contains the minimum needed to detect the file as containing a virus (copied your virustrap address, as well, in case this gets blocked to the list).
It certainly does.
The question is whether the AV program is expecting the headers.
If there is not a fix coming for this, would you consider sending the entire message file to the scanner?
There isn't any known bug here. This would be considered a very low priority, as it does not affect AV scanning, except that we need to be sure that there isn't a problem where actual viruses would not be properly detected.
The test.txt file you sent does *not* match the actual HTML of the original E-mail. The CR/LFs were off, and there was a part at the end that was missing. And, the length of the HTML segment that was decoded (per the log files) doesn't match the length of the HTML segment in the E-mail you sent.
After further analysis, it seems that the problem is with the AV software. Specifically, the E-mail you sent was using quoted-printable encoding, yet the body of the E-mail wasn't encoded using quoted-printable encoding. So when it had a line:
alink="#000099">
Declude Virus decoded it to something like:
alink"#000099">
The AV software was probably looking for the way that you (incorrectly) decoded it.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
