Exim, ClamAV, Bagle.[QRST]

[Tony Finch]

Note that Clam's current signature for the latest Bagle worms doesn't
work because it assumes that newlines are in SMTP CRLF form, whereas
Exim converts them to Unix LF form before Clam gets to see the message.
You can create a local.db file in your clamav database directory containing
the following signatures:

Exploit.HTML.Bagle.Q-fixed-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e7420666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.R-fixed-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e742020666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e

Tony.
--
f.a.n.finch  <dot at dotat.at>  http://dotat.at/
BISCAY SOUTHEAST FITZROY: WESTERLY 4 INCREASING 5 TO 7, INCREASING IN NORTH
BISCAY GALE 8, PERHAPS SEVERE GALE 9 LATER. THUNDERY RAIN. MODERATE WITH FOG
PATCHES, BECOMING GOOD.