From clamav-users-bounces@lists.clamav.net Thu Aug 9 02:52:08 2007 Return-Path: X-Original-To: list@tad.clamav.net Delivered-To: list@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0g21Aq0kUS4o; Thu, 9 Aug 2007 02:52:08 +0200 (CEST) Received: from tad.clamav.net (localhost.localdomain [127.0.0.1]) by tad.clamav.net (Postfix) with ESMTP id 72C4031C1C7; Thu, 9 Aug 2007 02:51:56 +0200 (CEST) X-Original-To: clamav-users@tad.clamav.net Delivered-To: clamav-users@tad.clamav.net X-Virus-Scanned: Debian amavisd-new at tad.clamav.net Received: from tad.clamav.net ([127.0.0.1]) by localhost (tad.clamav.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aJ07tt-5wOpS for ; Thu, 9 Aug 2007 02:51:52 +0200 (CEST) Received: from inetnw.com (inetnw.com [65.101.150.185]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by tad.clamav.net (Postfix) with ESMTP id CA90731C1AF for ; Thu, 9 Aug 2007 02:51:51 +0200 (CEST) Received: from [192.168.0.10] (wireless.inetnw.com [192.168.1.2]) by inetnw.com (8.14.1/8.14.1) with ESMTP id l790pm9w020216 for ; Wed, 8 Aug 2007 17:51:49 -0700 (PDT) Message-ID: <46BA6528.2010500@inetnw.com> Date: Wed, 08 Aug 2007 17:51:52 -0700 From: Dennis Peterson User-Agent: Thunderbird 1.5.0.12 (Macintosh/20070509) MIME-Version: 1.0 To: ClamAV users ML References: <12056326.post@talk.nabble.com> <46B9F0F5.4060808@roaringpenguin.com> <12057457.post@talk.nabble.com> <46B9F894.90307@roaringpenguin.com> <46B9FACC.60607@inetnw.com> <46B9FC01.1000309@roaringpenguin.com> <46B9FDA4.3060306@inetnw.com> In-Reply-To: X-Miltered: at omak with ID 46BA6524.000 by Joe's j-chkmail (http://inetnw.net/spam.php)! Subject: Re: [Clamav-users] Missed Virus X-BeenThere: clamav-users@lists.clamav.net X-Mailman-Version: 2.1.9 Precedence: list Reply-To: ClamAV users ML List-Id: ClamAV users ML List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: clamav-users-bounces@lists.clamav.net Errors-To: clamav-users-bounces@lists.clamav.net Jason Bennett wrote: > Hi everyone, > > We're using ClamAV on our mail gateway which is in front of our exchange server. It's been running great for a long time and stops thousands of virus per day for us. Lately however our McAfee which is installed on exchange itself is picking up this virus: > > W32/Zhelatin.gen!eml > > It seems our ClamAV is not seeing it. We get a couple hundred of these a day and they're all the same virus. > > Any ideas? > Is it possible it's only a partial message? It does happen that different tools looking at different parts of a message that is broken will see or miss the parts they use to identify a virus. dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html