On Fri, 3 Feb 2006, Diego d'Ambra wrote: > I'm investigating this. > > I believe that signature small-1004 is matching some sort of PE > packer/obfuscater and must be updated to avoid detecting unrelated malware.
Personally, I'm not as interested in naming the viruses as much as blocking them. If there is a signature that blocks multiple malware, based on some obfuscater that is in common use, this seems like a good thing, since there would be the potential of blocking future malware that uses it before we ever see it. ========================================================== Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/ _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
