ClamAV + worm in mbox file

[Christof Damian]

On Tue, 25 May 2004, Ow Mun Heng wrote:
>
> That;s not an idea which I don't mind doing.  The only thing is, I
> have _no_ idea which message contains the worm!
> 

you could try something like this, use formail and a little
script. its a bit slow, but it worked for me. you can use diff on the
mailboxes to see the virus.

formail < evilmailbox -s thescript.sh > nicemailbox

#!/bin/bash
TEMP=`mktemp`
cat > $TEMP
clamscan --quiet --unzip --mbox $TEMP 
if [ $? == 0 ]; then
  cat $TEMP
fi
rm $TEMP
  


-- 
Christof Damian         
christof at damian.net