On Wed, 27 Oct 2004 at 19:14:04 +0200, Jacek Politowski wrote: > We have one client, who was trying to send some MS Word (doc) file > from Outlook Express. > > Message was rejected by Exiscan with ClamAV 0.80: > Wed Oct 27 10:56:19 2004 -> > /var/spool/exim/scan/1CMjao-0004ts-Qg/1CMjao-0004ts-Qg.eml: Worm.SomeFool.P FOUND > Wed Oct 27 10:56:19 2004 -> > /var/spool/exim/scan/1CMjao-0004ts-Qg/1CMjao-0004ts-Qg-00000.doc: Worm.SomeFool.P > FOUND > > I can't remember SomeFool virus infecting MS Word files. > I thought actually it was some kind of worm, so I'm not sure if this > file is not a false positive. > > Unfortunately I can't get this suspicious file from our client, so I > only want to verify if it's possible to have MS Word file infected by > SomeFool.P.
Even if it can't be infected "automatically", I wouldn't be surprised if a MS Office file contained a worm. One can insert various bizarre "objects" into Office files. So, without examining the sample, one can't say if it contained a malware or whether it was a false positive. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/iso/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
