clamscan

[Peter Lesterhuis]

>
>
>Hi,
>> I did a clamscan on my system and found 2 infected files in thunderbird,
>> one in the trash-folder and the other one in the inbox-folder. I emptied
>> the trash-folder as well as all messages inside the inbox-folder. I ran
>> clamscan again and was surprised to notice that the inbox was still
>> infected, while it seemed empty. When I browsed to the inbox folder with
>> the file browser (applications-file browser) and opened the folder with
>> gedit it became clear that the folder wasn't empty at all. It contained
>> still 10 MB messages (??!!) I deleted these. I checked the folder and
>> now it really was empty. Again I ran clamscan but the the log file
>> indicates the infected file is still there:
>>
>> Scan started: Thu May 12 09:56:28 2005
>>
>> /home/peter/.thunderbird/43r07o17.default/Mail/Local Folders/Inbox~:
>> Worm.Sober.P FOUND
>>
>> -- summary --
>> Known viruses: 34297
>> Engine version: 0.84
>> Scanned directories: 1871
>> Scanned files: 19716
>> Infected files: 1
>> Data scanned: 1029.98 MB
>> Time: 426.309 sec (7 m 6 s)
>>
>> Am I being fooled by clamav?
>> Peter.
>  
>
>
>To remove this file go to the directory
>
> /home/peter/.thunderbird/43r07o17.default/Mail/Local Folders/
>
>and remove "Inbox~"  directly
>
>or in xterm 
>
>rm  /home/peter/.thunderbird/43r07o17.default/Mail/Local Folders/Inbox~
>  
>

This I did and I 've got rid of the infected file!
Peter.