Re: [Clamav-users] 0.91 - high load under solaris

From: <clamav-users(at)utdallas.edu>
Date: Mon Sep 10 2007 - 13:11:12 EDT

• Bill Landry said the following on 8/30/07 10:51 PM:
  >
  > Not all SaneSecurity signatures need to see the full message. If I
  > recall correctly, it's only the mail file type (designated by :4: in the
  > signature) that need to see the headers and body together. Anyway, as
  

I received a question about this particular ecard business:

http://secunia.com/virus_information/40057/zhelatin.geneml/

Apparently GroupShield is catching this, but ClamAV is not. Do you know if ClamAV needs to see the entire message in order to catch this one?

Thanks,
Amos

---

Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html Received on Mon Sep 10 13:14:03 2007