3

Today I ran a clamscan -ri / and got some positives for some malware. Most are in the "spam" folder, so that's no problem. But one is among my saved e-mails:

/home/user/.icedove/bfa059u1.default/ImapMail/imap.server.com/INBOX.sbd/saved: Doc.Dropper.Agent-1552723 FOUND

"Icedove" is Debian's rebranded Thunderbird. "saved" is the folder under the inbox that contains the message with the malware.

Is there any way to get more info from Clamscan to find out the name of the attachment that contains the malware?

How can I find out which particular e-mail that contains this program?

Related posts:

https://superuser.com/questions/107261

Community
  • 1
PetaspeedBeaver
  • 1,207
  • 3
  • 15
  • 32

1 Answers1

3

Make a copy of your mbox to Maildir format, for example using this Perl script or the terminal mail client mutt(1). Then clamscan that maildir – as each message is stored in a separate file in the maildir format, you'll be able to identify the offending message and hence be able to remove it from your original mbox ...

countermode
  • 7,373
  • 5
  • 31
  • 58
Matija Nalis
  • 3,061
  • 1
  • 14
  • 27