Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Al Varnell
No, Daily - 22782 says Win.Trojan.Toa-5368540-0 is a New signature, not one of the 11,296 dropped. -Al- On Mon, Dec 26, 2016 at 08:11 PM, Joel Esler (jesler) wrote: > > I believe that signature has been dropped. smime.p7s Description: S/MIME cryptographic signature

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Joel Esler (jesler)
I believe that signature has been dropped. -- Sent from my iPhone > On Dec 26, 2016, at 11:08 PM, Christian Balzer wrote: > > > Hello, > >> On Tue, 27 Dec 2016 03:06:31 + Joel Esler (jesler) wrote: >> >> We QA against thousands of clean files for each signature. But we

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Christian Balzer
Hello, On Tue, 27 Dec 2016 03:06:31 + Joel Esler (jesler) wrote: > We QA against thousands of clean files for each signature. But we don't have > s copy of every foe in the world to QA against. > > When people send in false positives, if we determine them to be actually > clean, we

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Joel Esler (jesler)
We QA against thousands of clean files for each signature. But we don't have s copy of every foe in the world to QA against. When people send in false positives, if we determine them to be actually clean, we add them to the FP farm as well. That's why FPs are important to send in, not just

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Christian Balzer
Hello Al, On Mon, 26 Dec 2016 17:52:53 -0800 Al Varnell wrote: > Although most, if not all the Win.Trojan.Toa old signatures were either > dropped by Daily - 22782, I see it also added Win.Trojan.Toa-5368540-0, so > that would appear to be a new issue. > Be that as it may, I'd say this isn't

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Al Varnell
Although most, if not all the Win.Trojan.Toa old signatures were either dropped by Daily - 22782, I see it also added Win.Trojan.Toa-5368540-0, so that would appear to be a new issue. -Al- On Mon, Dec 26, 2016 at 05:24 PM, Christian Balzer wrote: > > Hello, > > On Mon, 26 Dec 2016 19:21:25

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Christian Balzer
Hello, On Mon, 26 Dec 2016 19:21:25 - Steve Basford wrote: > > On Mon, December 26, 2016 6:55 pm, Mark Edwards wrote: > > In keeping with the other false positive reports I have more than 400 > > CentOS servers report below after yesterday's freshclam update: > > Yes, nashorn.jar seems to

Re: [clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Steve Basford
On Mon, December 26, 2016 6:55 pm, Mark Edwards wrote: > In keeping with the other false positive reports I have more than 400 > CentOS servers report below after yesterday's freshclam update: Yes, nashorn.jar seems to get hit too... eg: fp2\11476331d01: Win.Trojan.Toa-5372078-0

[clamav-users] Probable False Positive - OpenJDK-1.8 nashorn.jar : Win.Trojan.Toa-5370166-0

2016-12-26 Thread Mark Edwards
In keeping with the other false positive reports I have more than 400 CentOS servers report below after yesterday's freshclam update: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.111-1.b15.el7_2.x86_ 64/jre/lib/ext/nashorn.jar: Win.Trojan.Toa-5370166-0. Believe this is a false positive Would like