[Pkg-clamav-devel] Bug#589767: clamav: clamscan gives opposite results on mbox file vs. maildir file

[Jeffrey B. Green]

On 09/08/2010 06:45 AM, Michael Tautschnig wrote:
> tags 589767 + upstream
> forwarded 589767 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2253
> thanks
>
>> Michael writes:
>>> [...]
>>>
>>> I guess you could zip the file, make the archive password protected and
>>> send the
>>> password along :-) That way anybody could get a chance to read it. If you
>>> prefer
>>> the gpg variant, my public key is attached.
>>>
>>
>> I found alternate ways to do my work. Anyway, attached is a gpg symmetric
>> encrypted file that I referred to in earlier messages.
>>
>> The password is "debian".
>>
>
> It seems that whatever mailserver software you might be using, it adds some X-*
> headers at the very beginning of the email message. Consequently clamav fails to
> detect this as a Maildir file and treats it as ASCII text instead. It then fails
> to conclude that it is a phishing message. I've asked upstream to improve their
> detection capabilities.

Postfix.

>
> Thanks a lot for reporting this and providing all the necessary debugging
> information!
>

And thank you for all of the work that you do for Debian. I wish that I 
had more time to help out. I miss out on a lot of the code work in my 
present job incarnation. I start to get into it when immediately I'm 
pulled in another direction.

-jeff