clamscan

[Wong Kwok-hon]

On 5/12/05, Peter Lesterhuis <peterlesterhuis at tiscali.nl> wrote:
> Hi,
> I did a clamscan on my system and found 2 infected files in thunderbird,
> one in the trash-folder and the other one in the inbox-folder. I emptied
> the trash-folder as well as all messages inside the inbox-folder. I ran
> clamscan again and was surprised to notice that the inbox was still
> infected, while it seemed empty. When I browsed to the inbox folder with
> the file browser (applications-file browser) and opened the folder with
> gedit it became clear that the folder wasn't empty at all. It contained
> still 10 MB messages (??!!) I deleted these. I checked the folder and
> now it really was empty. Again I ran clamscan but the the log file
> indicates the infected file is still there:
> 
> Scan started: Thu May 12 09:56:28 2005
> 
> /home/peter/.thunderbird/43r07o17.default/Mail/Local Folders/Inbox~:
> Worm.Sober.P FOUND
> 
> -- summary --
> Known viruses: 34297
> Engine version: 0.84
> Scanned directories: 1871
> Scanned files: 19716
> Infected files: 1
> Data scanned: 1029.98 MB
> Time: 426.309 sec (7 m 6 s)
> 
> Am I being fooled by clamav?
> Peter.

No, it is really infected.


Wong Kwok Hon