Marc Balmer wrote:
> On Sun, 24 Aug 2003 15:10:10 +0100, Nigel Horne wrote:
>
>
>>Marc Balmer wrote:
>>
>>
>>>This product seems not ro recognise Sobig.F. Would it be difficult to
>>>add a signature?
>>
>>What signature date and version on ClamAV do you have? It recognises it on
>>my system.
>
>
> I found out today that Clamav detects Sobig.F and all other viruses if
> and only an E-mail file starts with "From ". This is a defect in the
> Software. The problem is, that clamav uses some weird magic strings,
> MAIL_MAGIC_STR in this case, to recognize that a file is an e-Mail
> message.
>
> RFC compliant mail files do not start with "From " AFAIK, at least and
> even if they do there should be a better and explicit way to tell clamav
> to treat a file as email.
>
> E.g. if your wite a sendmail milter ouy will write out the header and
> message body to a temp file. Such a temp file will not start with
> "From ".

Try posting problem to comp.mail.sendmail, I'm sure someone there has a
workaround

MK