On Wed, 28 Apr 2004 at 13:42:07 +0200, Ralf Guenthner wrote: > > First of all: Kudos to the ClamAV team it's so useful in stopping worms. > > On to my question: > For some reason, clamav is labelling almost each virus it finds in > incoming mail as "Win32.Mix" like so > > Wed Apr 28 12:28:30 2004 -> > /var/spool/qmailscan/tmp/mx2108314810947010970/data.rtf > .scr: > Win32.Mix FOUND > > I am sure that is rather a sample of the Netsky worm, which other > systems running clam identify as "Worm.Somefool.xx" > > What could be the cause of the wrong name? >
I guess that you use very old database - Win32.Mix isn't present in the database since the end of February 2004. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
