----- Original Message ----- From: "Matt" <[EMAIL PROTECTED]>
> I believe that Declude creates a directory for all attachments in each > message, and then Declude calls the scanner to scan the entire > directory. I believe that for inline content such as text/plain and > text/html, these files will be saved in those directories according to > the MIME boundaries. For you to properly replicate the circumstances, > it would be a good idea to save an HTML file (example.html) with the > body content of this message in a directory with nothing else in it, and > then call trend to scan the directory and not specifically the file. > > One possibility here is that TrendMicro doesn't detect this as a virus > when it is called to scan the directory like Declude does, and the above > should expose whether or not this is the case. Okay, here is what I did. Created a directory called test and copied the test.txt file into this directory as test.html. I opened the test.html file with Internet Explorer and the page looks just like the received e-mail (yellow background, italicized test, and a hypertext link). I then call TrendMicro to scan the directory as: ===== M:\temp>C:\Progra~1\Trend\Sprotect\vscantm.bin /NBPM /NM /NB /NC /Q /VSTEMP=m:\temp\ /LR=report.txt m:\temp\test\*.* And it came back with: ===== 1 files have been checked. Found 1 files containing viruses. ===== Here is the report.txt file: ===== Copyright (c) 1990 - 2004 Trend Micro Inc. Report Date : 11/28/2004 17:20:08 VSAPI Engine Version : 7.000-1004 VSCANTM Version : 1.1-1001 Virus Pattern Version : 265 (76358 Patterns) (2004/11/26) (226500) Command Line: C:\Progra~1\Trend\Sprotect\vscantm.bin /NBPM /NM /NB /NC /Q /VSTEMP=m:\temp\ /LR=report.txt m:\temp\test\*.* Found [ HTML_BOFRA.B]( 1) in m:\temp\test\test.html 1 files have been read. 1 files have been checked. 1 files have been scanned. 1 files have been scanned. (including files in archived) 1 files containing viruses. Found 1 viruses totally. Maybe 0 viruses totally. Stop At : 11/28/2004 17:20:09 0.00 seconds has elapsed. ===== Thoughts? Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
