From clamav-users-bounces@lists.clamav.net Wed Aug 8 21:00:59 2007 Return-Path: X-Original-To: list@tad.clamav.net Delivered-To: list@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QcZD6xA8NNwp; Wed, 8 Aug 2007 21:00:58 +0200 (CEST) Received: from tad.clamav.net (localhost.localdomain [127.0.0.1]) by tad.clamav.net (Postfix) with ESMTP id 5E272324111; Wed, 8 Aug 2007 21:00:48 +0200 (CEST) X-Original-To: clamav-users@tad.clamav.net Delivered-To: clamav-users@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IheLnnoOC+pI for ; Wed, 8 Aug 2007 21:00:41 +0200 (CEST) Received: from farallon.riovia.com (farallon.riovia.com [200.40.150.118]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by tad.clamav.net (Postfix) with ESMTP id 0BDC5324101 for ; Wed, 8 Aug 2007 21:00:40 +0200 (CEST) Received: from farallon.riovia.com (localhost [127.0.0.1]) by farallon.riovia.com (Postfix) with ESMTP id 4DCECA28603 for ; Wed, 8 Aug 2007 16:00:37 -0300 (UYT) Received: from [10.10.203.70] (unknown [10.10.203.70]) by farallon.riovia.com (Postfix) with ESMTP id 2BC5BA280F5 for ; Wed, 8 Aug 2007 16:00:37 -0300 (UYT) Message-ID: <46BA12D6.4030106@bolso.ptraced.net> Date: Wed, 08 Aug 2007 16:00:38 -0300 From: rafa User-Agent: Thunderbird 1.5.0.12 (Windows/20070509) MIME-Version: 1.0 To: ClamAV users ML References: <12056326.post@talk.nabble.com> <46B9F0F5.4060808@roaringpenguin.com> <12057457.post@talk.nabble.com> <46B9F894.90307@roaringpenguin.com> <46B9FACC.60607@inetnw.com> <46B9FC01.1000309@roaringpenguin.com> <46B9FDA4.3060306@inetnw.com> In-Reply-To: X-Virus-Scanned: by ClamSMTP at farallon.riovia.com Subject: Re: [Clamav-users] Missed Virus X-BeenThere: clamav-users@lists.clamav.net X-Mailman-Version: 2.1.9 Precedence: list Reply-To: ClamAV users ML List-Id: ClamAV users ML List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: clamav-users-bounces@lists.clamav.net Errors-To: clamav-users-bounces@lists.clamav.net Jason Bennett wrote: > Hi everyone, > > We're using ClamAV on our mail gateway which is in front of our exchange server. It's been running great for a long time and stops thousands of virus per day for us. Lately however our McAfee which is installed on exchange itself is picking up this virus: > > W32/Zhelatin.gen!eml > > It seems our ClamAV is not seeing it. We get a couple hundred of these a day and they're all the same virus. > > Any ideas? > > Thanks for any help > > Jason Zhelatin is the Email.Phishing.RB-1xxx If you are using amavisd-new you shoud give clamd with the full email message. @keep_decoded_original_maps = (new_RE( qr'^MAIL$', # retain full original message for virus checking )); _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html