On 5/23/06, Kelson <[EMAIL PROTECTED]> wrote:
Jan Pieter Cornet wrote: > Maybe "tons" is slightly exaggerated? Out of approximately 10 million > emails today, our logs show one hit for XF.Sic.L, and then another hit > when that email was bounced because of the reject we gave. If their customer is trying repeatedly to send "a bunch" of files that trigger false positives on that rule, then yes, they're going to see "tons" of them -- regardless of the number of hits in anyone else's logs. -- Kelson Vibber SpeedGate Communications <www.speed.net> _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
Tons maybe a little exaggerated but like Kelson said the users keep retrying cause they don't get any notification that it is getting blocked so the send it again. Removing the def from the cvd file is an option but would be anoying to maintain over time. I would really like to know why this is happening and get it fixed from the source and not a work around that we'll have to maintain. (Trend, Symantic and Mcafee all said there wasn't anything wrong with the file) I even took the file converted it to ODF format then back to Excel and it still gave me a false positvie. I stripped out he macros too and it still doesn't like it. My hunch is that there is a problem with the way that particular def works. _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
