Joe Evans schrieb: > Can anyone shed some light on the log entries below? > > (1) "Can't calculate offset for signature Trojan.Mybot-5073" > (2) "Broken PE file" >
The file is broken. This happens very often with such samples (SdBot/Mybot). With ClamAV .9x the recognition of broken executables was greatly improved. While 0.8x doesn't care too much about it, 0.9x is more strict and refuses to start offset calculations on broken files. It's not a big deal since such files usualy wont run. -- Best regards, Christoph mailto:[EMAIL PROTECTED] _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
