On Fri, 10 Oct 2003 at 6:42:46 -0700, Ricardo Kleemann wrote: > > I just noticed something strange... I have a virus file that > McAffee VirusScan reports as Swen, and clamd reports as > Worm.Gibe.F
That's right. > Do those have similar signatures? I wonder why that would > be. Those are the same virus. See e.g. http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] "(...) Also Known As: Swen [F-Secure], W32/[EMAIL PROTECTED] [McAfee], W32/Gibe-F [Sophos], I-Worm.Swen [KAV], Win32 Swen.A [CA], WORM_SWEN.A [Trend], Worm.Automat.AHB [Previous Symantec Detection]". Various AV vendors use various names for the same virus. ClamAV tries to use the most appropriate and common name when releasing a signature but when there's an outbreak of some new virus, it is more important to update the database quickly than to survey possible names :-) . -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. SourceForge.net hosts over 70,000 Open Source Projects. See the people who have HELPED US provide better services: Click here: http://sourceforge.net/supporters.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
