One of my customers in Eastern Washington just got some mail blocked because of
this non-Clamav pattern:
:INetMsg.SpamDomain-2w.gonzaga_edu:4:*:(2e|2f|40|20|3c|5f)676f6e7a6167612e656475(27|22|20|2f|3d|5f|3e|0a|0d)
No way I'm telling the Zag's they're not getting their mail :)
Point being is it looks like a good example of how to carefully craft signatures
that will generate false positives.
dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
