PUA.PDF.OpenActionObject has been dropped and has been replaced with the signatures below:
PUA.Script.PDF.OpenActionObjectwithJavascript PUA.Script.PDF.OpenActionObjectwithJS Thanks, -Alain On Sun, Apr 24, 2011 at 5:03 AM, Johannes Schulz <[email protected]> wrote: > "sigtool -fPUA.PDF.OpenActionObject|sigtool --decode-sigs" says: > VIRUS NAME: PUA.PDF.OpenActionObject > TARGET TYPE: ANY FILE > OFFSET: 0 > DECODED SIGNATURE: > %PDF-{WILDCARD_ANY_STRING}obj{WILDCARD_ANY_STRING(LENGTH<=2)}<<{WILDCARD_ANY_STRING}/OpenAction > > > /OpenAction comes in two variants - the PDF Referance says: > > A value specifying a destination to be displayed or an action to be > performed when the document is opened. The value is either an array > defining a destination (see Section 8.2.1, “Destinations”) or > an action dictionary representing an action (Section 8.5, “Actions”). > If > this entry is absent, the document should be opened to the top of the > first page at the default magnification factor. > > > An OpenAction such as "/OpenAction [4 0 R /Fit]" is harmless ? > > -- > Thanks > > Johannes Schulz > > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
