> Maybe it is good idea to separate macro viruses into different file? Or the ability to exclude macro virii from the scanned for items.
> > > clamav found a lot a of my files (ms word doc) infected by "W97M/Story" > > > "WM.Cap" viruses. I tried to scan them with NAV and avast! (both with > > > recent db updates) and none of them was found infected. Is there someone > > > maintaining W97M/Story and WM.Cap viruses in clamav db? I can send > > > some files to investigate this issue. Thanks. > > We don't have a proper mechanism for OLE2 scanning. Because that > > match compressed data usually they are created only to match a plain ASCII > > strings. Very often such signatures cause false positive alerts. A real > > OLE2 stream reader will be implemented in the next month (I do already have > > draft) and signatures for macro viruses will be regenerated. Excellent, clamav-milter/clamd have been stable for us for awhile [which is great], but now the false positives with W97/Marker are driving us nuts! :) But this still beats our previous solution (uvscan). ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
