Today I ran a clamscan -ri / and got some positives for some malware. Most are in the "spam" folder, so that's no problem. But one is among my saved e-mails:

/home/user/.icedove/bfa059u1.default/ImapMail/imap.server.com/INBOX.sbd/saved: Doc.Dropper.Agent-1552723 FOUND

"Icedove" is Debian's rebranded Thunderbird. "saved" is the folder under the inbox that contains the message with the malware.

Is there any way to get more info from Clamscan to find out the name of the attachment that contains the malware?

How can I find out which particular e-mail that contains this program?

Related posts:



Make a copy of your mbox to Maildir format, for example using this Perl script or the terminal mail client mutt(1). Then clamscan that maildir – as each message is stored in a separate file in the maildir format, you'll be able to identify the offending message and hence be able to remove it from your original mbox ...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.