Ahhh..
So Declude doesn't actually Send the SMD file to the Scanner..
It takes the Message Body, wirtes it to a Tmp File, and then scans it? Why not just scan the SMD file , Headers and All ?
----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Monday, December 20, 2004 4:41 PM
Subject: Re: Re[6]: [Declude.Virus] testvirus.org #17
But the Mcafee DOES detect the Virus string in the SMD file., But declude reports no virus.
(This is for test #17)
Declude Virus doesn't detect a virus, because there are no vulnerabilities in the E-mail (despite what the test description says).
McAfee does not detect it when called by Declude Virus, because Declude Virus only sends MIME segments, attachments, and other such files to McAfee. Since the eicar.com file appears in the headers, where mail clients should be unable to see an attachment, the eicar.com file isn't sent to McAfee.
As to why McAfee detects it, it is most likely due to differences in the way that the E-mail is scanned.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
----
This outgoing message is guaranteed to be authentic by Message Level users.
Guarantee the authenticity of your email @ http://www.messagelevel.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- This email has been scanned for possible viruses by Declude Antivirus. For more information on Declude Antivirus, Visit www.declude.com
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
