On Mon, 21 Jun 2004 at 15:02:45 -0500, [EMAIL PROTECTED] wrote: > Benjamin Sherman said: > > I was wondering if false positives ever make it into the virus DB updates? > > > > Since the update on Jun18, all of my windows 2000 workstations with > > Service Pack 4 are showing what I beleive to be false positives for > > Worm.Lovgate.W-2. The file in question is "spoolsv.exe" and can be fond > > in: > > C:\WINNT\System32 > > C:\WINNT\System32\DllCache > > C:\WINNT\ServicePackFiles\i386 (depending on how the service pack was > > installed) > > > > These machines exhibit none of the symptoms of the Lovgate family of > > virii except that ClamAV started picking them up after the database > > update on Friday Jun18. > > > > Any suggestions? > > > > I'm seeing the same thing since sp4. You are not alone. >
Just to calm down all of you a little: we confirm the case. Working on it. The false signature will be removed/corrected soon. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/iso/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
