On Thu, 23 Oct 2003 04:05:36 -0400
lists <[EMAIL PROTECTED]> wrote:
> > The correct fix is to submit such falsely infected file via normal
> > way: < http://clamav.sourceforge.net/cgi-bin/sendvirus.cgi >,
>
> i have a bit of a problem - the WordMacro.Concept and W97M/Story.A
> false positives appear in older Word97 files that contain business
> data. if i remove the textual content of the file and resave
> (presumably preserving macros), the file no longer gives a false
> positive.
>
> any suggestions?
Most of our signatures for Office viruses are broken - this is because
we have no support for compressed VBA streams in OLE2 files and the
signatures only match compressed data. Support for VBA will be available
soon, though (but not in the next stable release).
Best regards,
Tomasz Kojm
--
oo ..... [EMAIL PROTECTED]
(\/)\......... http://www.konarski.edu.pl/~zolw
\..........._ I nie zapomnij kliknac w brzuszek...
//\ /\\ <- C. Amboinensis www.pajacyk.pl
-------------------------------------------------------
This SF.net email is sponsored by: The SF.net Donation Program.
Do you like what SourceForge.net is doing for the Open
Source Community? Make a contribution, and help us add new
features and functionality. Click here: http://sourceforge.net/donate/
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
