On 11/25/05, Richard Pijnenburg <[EMAIL PROTECTED]> wrote: > > Okay, So if i understand you correctly, Sober.Y == Sober.U ?
Viruses mutate frequently, and different vendors give different names to viruses as they get ahold of samples. And, there's no strict line between versions; one program might identify two samples as being two different Sober variants; another program might call them both the same variant. THere's *no way* to tell for sure whether your program's "Sober Y" is Clamav's "Sober.U" without catching a live sample. There are a couple of folks out there trying to keep track of names between antivirus programs (check the list archives), but it's pretty much an uphill battle. Other than knowing that somefool == Netsky, I don't bother. If your problem is that some live viruses are getting through, and you've got the latest clamav and defs installed, snag a live copy and follow the instructions for uploading it at www.clamav.net . cheers Betsy PS before submitting a sample, take the simple step of updating your definitions and emailing it back to yourself. The definitions are updated so frequently that you may find something that got through yesterday is blocked today. It doesn't happen often but every once in a while McAffee or Symantec beats ClamAV to the punch for a new variant by a few hours. _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
