ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
VIRUS - Clamwin false positive w/ html emails?
su


Joined: 14 Nov 2007
Posts: 0
Reply with quote
Hello,

We just installed Clamwin with both hmailserver and abilitymailserver, two mailserver software that we are testing. When sending html emails, on both of them, the subject of the email was edited with VIRUS coming from Clamwin. Yet, the emails and the PCs originating/sending the emails don't have a virus (we checked with both Norton and Avast). Is there an issue with html emails and Clamwin or a setting that needs to be changed please?

Michael
View user's profileSend private message
Re: VIRUS - Clamwin false positive w/ html emails?
b0ne


Joined: 26 Oct 2006
Posts: 0
Reply with quote
su wrote:
Is there an issue with html emails and Clamwin or a setting that needs to be changed please?


What was it that ClamWin say was detected? ClamAV detects more than just viruses, it detects attempted phishing attempts and the like, most of which occur via email messages.
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 9
Location: USA
Reply with quote
If you can find a specific file, you might want to upload it to Jotti at https://virusscan.jotti.org/ for a check with 20 AV programs or to VirusTotal at https://www.virustotal.com/ for a check with 32 AV programs. Clam has some html signatures but some other AVs might not.

Regards,
View user's profileSend private message
su


Joined: 14 Nov 2007
Posts: 0
Reply with quote
bone, it just adds VIRUS in the subject. It was also removing the body of the email but I changed that option so it would allow it.
View user's profileSend private message
su


Joined: 14 Nov 2007
Posts: 0
Reply with quote
GuitarBob, VirusTotal shows all OK (including ClamAV believe it or not) except for Webwasher-Gateway 6.0.1 2007.11.14 where it shows error code: BlockReason.0, any idea what that is? virusscan.jotti.org 'found nothing' for all. Thank you.
View user's profileSend private message
b0ne


Joined: 26 Oct 2006
Posts: 0
Reply with quote
su wrote:
bone, it just adds VIRUS in the subject. It was also removing the body of the email but I changed that option so it would allow it.


How are you scanning it on virus total? If you save the email, with all attachments embedded, in the RFC-822 (.eml extension in Outlook Express) and scan it with ClamWin it tell you what detection is being issued.
View user's profileSend private message
VIRUS - Clamwin false positive w/ html emails?
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic