On Sun, 10 Apr 2005 10:44:57 +0200 Róth Tamás <[EMAIL PROTECTED]> wrote:
> Hi all, > > i have a small question on the virus naming, if i run the following > two lines on Linux i get different result, any reason for this? > > sigtool -l | wc -l > 32207 > > sigtool -l | uniq | wc -l > 31912 > > If i'm correct there are many viruses with duplicate names, or some > virus with multiple identification? Some of the duplicate names are mistakes (and should be named -1, -2, .A, .B, etc.) and some of them are intentional because one (or more) of the signatures was created to detect broken/damaged variants and due to the limitations of the old engine they weren't called something-dam because they could possibly report a working instance of a malware as damaged. -- oo ..... Tomasz Kojm <[EMAIL PROTECTED]> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Sun Apr 10 16:49:52 CEST 2005
pgpKbwaCW5fCo.pgp
Description: PGP signature
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
