UNKNOWN CLAMD RETURN

[UxBoD]

Hi Rick, 

I changed the code too :- 

my ($dot,$childname,$filename,$rest) = split('/',$results); 
if ($filename =~ /.+?\sFOUND$/ && $rest eq '') { 
$rest = $filename; 
$childname =~ s/\.header//; 
$filename = "message.header"; 
} 

and it now detects okay, including in MailWatch :D 

Rank Virus Percentage of detection 

1 	Html.Loan.Gen006.Sanesecurity.06120200 			43% 
2 	Html.Phishing.Bank.Rockv2Gen14.Sanesecurity.07060400 			37% 
3 	Email.Stk.Gen596.Sanesecurity.07071900.pdf 			11% 
4 	Html.Img.Gen013.Sanesecurity.06112900 			2% 
5 	Email.Hdr.Sanesecurity.07061900 			2% 
6 	Html.Phishing.Bank.Rockv2Gen28.Sanesecurity.07061800 			2% 
7 	Email.Stk.Gen591.Sanesecurity.07071800.pdf 			2% 
8 	Worm.Somefool.AR 			2% 



----- Original Message ----- 
From: "Rick Cooper" <rcooper at dwford.com> 
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info> 
Sent: Thursday, July 19, 2007 1:56:10 PM (GMT) Europe/London 
Subject: RE: UNKNOWN CLAMD RETURN 



> -----Original Message----- 
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On 
> Behalf Of Rick Cooper 
> Sent: Thursday, July 19, 2007 8:51 AM 
> To: 'MailScanner discussion' 
> Subject: RE: UNKNOWN CLAMD RETURN 
> 
> 
> 
> > -----Original Message----- 
> > From: mailscanner-bounces at lists.mailscanner.info 
> > [mailto:mailscanner-bounces at lists.mailscanner.info] On 
> > Behalf Of UxBoD 
> > Sent: Thursday, July 19, 2007 8:33 AM 
> > To: MailScanner discussion 
> > Subject: Re: UNKNOWN CLAMD RETURN 
> > 
> > Rick, 
> > 
> > That is the problem as it does not get flagged by MailWatch 
> > as a Virus, which I believe just grabs the whole line from 
> > MailScanner. 
> > 
> [...] 
> 
> I really wish I had that message |->( 
> 
> Try this: 
> 
> if ($filename =~ /.+?\sFOUND$/ && $childname =~ 
> /^.+\.header$) { 
> $rest = $filename; 
> $filename = $childname; 
> $childname =~ s/(.+)\.header$/$1/; 
> } 
> 

[...] 

Doh! Of course the first line should be: 

if ($filename =~ /.+?\sFOUND$/ && $childname =~ /^.+\.header$/) { 

Forgot the last '/' in "$childname =~ /^.+\.header$/" sorry 

Rick 


-- 
This message has been scanned for viruses and 
dangerous content by MailScanner, and is 
believed to be clean. 


-- 
MailScanner mailing list 
mailscanner at lists.mailscanner.info 
http://lists.mailscanner.info/mailman/listinfo/mailscanner 

Before posting, read http://wiki.mailscanner.info/posting 

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and 
dangerous content by MailScanner, and is 
believed to be clean. 


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070719/a18b7368/attachment.html