David Shrimpton wrote:
> I'm getting a run of what appear to be false positives
> on W97M.Static in word docs, since this signature was updated on 18/10/2008.
Me too.
> Is there a way of disabling it ?
I would like to know as well.
jon
--
Jon Milliren
Systems Administrator
U
Jon Milliren wrote:
> David Shrimpton wrote:
>
>> I'm getting a run of what appear to be false positives
>> on W97M.Static in word docs, since this signature was updated on 18/10/2008.
>
> Me too.
>
>> Is there a way of disabling it ?
>
> I would like to know as well.
>
> jon
>
Hi there,
On Wed, 29 Oct 2008 David Shrimpton wrote:
> Surely this signature is incorrect .
>
> Is there a way of disabling it ?
See section 2.5 of
http://www.clamav.net/doc/latest/signatures.pdf
--
73,
Ged.
___
Help us build a comprehensive ClamAV
On Wed, 29 Oct 2008, Noel Jones wrote:
> Submit false positives to the clamav team for analysis.
> http://www.clamav.net/sendvirus/
Thanks, Was done earlier.
>
> It appears this has already been fixed - I can't find a
> signature named W97M.Static in the current clam database.
W97M.Static was
David Shrimpton wrote:
>
> This suggests creating a local.ign file eg
>
> daily.ndb:319:W97M.Static
>
> where 319 is line number in daily.ndb of W97M.Static signature.
Yes, assuming the unwanted signature is in daily.ndb
> I tried this earlier but it did not work altough
> clamscan appear to i
On Sat, 2008-10-25 at 16:27 +0200, Karsten Bräckelmann wrote:
> Recent flood of (German only?) Trojan.Agent malware, partly slipping by
> ClamAV. So I now am submitting samples where I spot 'em...
FWIW, also reported by Heise (sorry, German only).
http://www.heise.de/security/news/meldung/117971
On Wed, 29 Oct 2008, Noel Jones wrote:
> David Shrimpton wrote:
> >
> > This suggests creating a local.ign file eg
> >
> > daily.ndb:319:W97M.Static
> > clamscan appear to indicate it was loading the file.
>
> Sounds as if you did it correctly, I have no insight into why
> it didn't work for
David Shrimpton wrote:
> On Wed, 29 Oct 2008, Noel Jones wrote:
>
>> David Shrimpton wrote:
>>> This suggests creating a local.ign file eg
>>>
>>> daily.ndb:319:W97M.Static
>>> clamscan appear to indicate it was loading the file.
>
>> Sounds as if you did it correctly, I have no insight into why
