On Thu, 18 Mar 2004, Tor Slettnes wrote:
>
> Well, I get zero viruses with the following snippet:
>
> # Unpack MIME containers and reject file extensions used by worms.
That won't work with Bagle.Q since its invection vector message doesn't
have any attachments.
I note that the ClamAV signature for Bagle.[QRST] assumes CRLF newlines,
but at least on my setup (Exim+MailScanner) the messages have had the CRs
removed by Exim before they get to ClamAV so the viruses are slipping
through :-( Fortunately the ClamAV signature format is open enough that I
can fix the problem :-)
--
Tony Finch <dot@???>
http://dotat.at/
