On 5/12/05, Peter Lesterhuis <peterlesterhuis@xxxxxxxxxx> wrote: > Hi, > I did a clamscan on my system and found 2 infected files in thunderbird, > one in the trash-folder and the other one in the inbox-folder. I emptied > the trash-folder as well as all messages inside the inbox-folder. I ran > clamscan again and was surprised to notice that the inbox was still > infected, while it seemed empty. When I browsed to the inbox folder with > the file browser (applications-file browser) and opened the folder with > gedit it became clear that the folder wasn't empty at all. It contained > still 10 MB messages (??!!) I deleted these. I checked the folder and > now it really was empty. Again I ran clamscan but the the log file > indicates the infected file is still there: > > Scan started: Thu May 12 09:56:28 2005 > > /home/peter/.thunderbird/43r07o17.default/Mail/Local Folders/Inbox~: > Worm.Sober.P FOUND > > -- summary -- > Known viruses: 34297 > Engine version: 0.84 > Scanned directories: 1871 > Scanned files: 19716 > Infected files: 1 > Data scanned: 1029.98 MB > Time: 426.309 sec (7 m 6 s) > > Am I being fooled by clamav? > Peter. No, it is really infected. Wong Kwok Hon
