From: Tomasz Papszun <[EMAIL PROTECTED]>
This is an intended behaviour. There was a long discussion in September 2003 whether we should detect (and block) damaged samples of Worm.Gibe.F. In the end we decided: yes. Such messages, though not containing executable viruses, are the result of the virus and were very troublesome and - by end users - not easily differentiated from real viruses.
Ah, I can understand that. I'd suggest though that a different signature name is used, one that makes it more obvious to the admin that it's blocked virus related traffic, not an actual virus. Otherwise you get into the "cry wolf" situation.
I'll just ignore clamav's alerting on Worm.Gibe.F in future as so far I've not yet received a single intact one :)
Please DO NOT send me ANY email directly unless it's a privacy issue. Reply-to mangled to assist those who don't read the above. -- Rob | What part of "no" was it you didn't understand?
_________________________________________________________________
Stay in touch with absent friends - get MSN Messenger http://www.msn.co.uk/messenger
------------------------------------------------------- This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek For a limited time only, get FREE Ground shipping on all orders of $35 or more. Hurry up and shop folks, this offer expires April 30th! http://www.thinkgeek.com/freeshipping/?cpg=12297 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
