[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-users
Subject:    [Clamav-users] LibClamAV Warning: Not all attachments will be scanned
From:       Daniel J McDonald <dan.mcdonald () austinenergy ! com>
Date:       2004-08-31 18:55:39
Message-ID: 1093978538.12580.28.camel () mcdonalddj-lnx ! electric ! ci ! austin ! tx ! us
[Download RAW message or body]

Checking my virus quarantine and came across:
$ clamscan --mbox --stdout virus-20040831-*
[...]
virus-20040831-102553-18818-02-12: Worm.Bagle.N FOUND
LibClamAV Warning: Not all attachments will be scanned
LibClamAV Warning: Not all attachments will be scanned
LibClamAV Warning: Not all attachments will be scanned
virus-20040831-102843-20225-01-18: OK
virus-20040831-103636-18818-02-44: Worm.SomeFool.I FOUND
[...]

virus-20040831-102843-20225-01-18 contains a midi file (which is why I
block it) and other fluff - is that the message that is not being
scanned?

The warning messages are sent to stderr instead of stdout  - I normally
grep for the OK messages and manually review them.

Incidentally, I've gotten a number of .chm files lately in a unicode
message.  Clamav hasn't twigged on them, but I ban them with amavis-new
anyway.  Are there any known exploits with .chm files, or is that just
another way to move SPAM around?
-- 
Daniel J McDonald, CCIE 2495, CNX
Austin Energy




-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Clamav-users mailing list
Clamav-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/clamav-users
[prev in list] [next in list] [prev in thread] [next in thread]