Diego d'Ambra wrote: >These signatures has been successful in preventing outbreaks of new of >Mytob/Bagle variants, which is why they're still in the db. FP has been >handled by explicit whitelisting binaries that also uses these packers >(e.g. IIRC an older version Kazaa).
How about using different virus names for these signatures, something like Packer.Win32.Morphine and Packer.Win32.PeX ? _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
