Which AV is right :) ?

[Christiaan den Besten]

> It is. People click on the attachment, which probably is an RFC822
> attachment", which opens up a new message window with (AFAIK) the same
> rules regarding opening and starting attachments. I know Agent has the
> possibility to show RFC822 attachments just as normal messages in your
> folder. Allthough it will ask you a whole lot of questions before you
> can start an attachment.
>
> >- "Clamscan --mbox [body of msg]" does find the Zafi.B virus.
> >
> >Should MailScanner do a double check ?.. one with and one
> without de mbox
> >parameter, or is F-Prot just to paranoid ?
> >
> >Which is right ?
>
> I would consider F-Prot to be right in protecting people used to
> clicking on attachments.

Ok, so might it be an idea to let the MailScanner clam-wrapper do a double
check ?.. one with and one without the '--mbox' parameter? Is that even
possible ?

Or perhaps the MailScanner mime-decoder should check if the 'decoded' part
is a valid multi-mime result and should decode that message as well ?... It
is a bit like a multi-level archive ...

bye,
Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).