On Thu, 2004-10-28 at 12:32, Tomasz Papszun wrote: > On Wed, 27 Oct 2004 at 19:14:04 +0200, Jacek Politowski wrote: > > We have one client, who was trying to send some MS Word (doc) file > > from Outlook Express. > > > > Message was rejected by Exiscan with ClamAV 0.80: > > Wed Oct 27 10:56:19 2004 -> > > /var/spool/exim/scan/1CMjao-0004ts-Qg/1CMjao-0004ts-Qg.eml: Worm.SomeFool.P FOUND > > Wed Oct 27 10:56:19 2004 -> > > /var/spool/exim/scan/1CMjao-0004ts-Qg/1CMjao-0004ts-Qg-00000.doc: Worm.SomeFool.P > > FOUND > > > > I can't remember SomeFool virus infecting MS Word files. > > I thought actually it was some kind of worm, so I'm not sure if this > > file is not a false positive. > > > > Unfortunately I can't get this suspicious file from our client, so I > > only want to verify if it's possible to have MS Word file infected by > > SomeFool.P. > > Even if it can't be infected "automatically", I wouldn't be surprised if > a MS Office file contained a worm. One can insert various bizarre > "objects" into Office files. > So, without examining the sample, one can't say if it contained a > malware or whether it was a false positive.
... or if it's even a MS Word file. -trog
signature.asc
Description: This is a digitally signed message part
_______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
