Christoph Cordes wrote: > Joe Evans schrieb: > > >> Can anyone shed some light on the log entries below? >> >> (1) "Can't calculate offset for signature Trojan.Mybot-5073" >> (2) "Broken PE file" >> >> > > The file is broken. This happens very often with such samples > (SdBot/Mybot). With ClamAV .9x the recognition of broken executables was > greatly improved. While 0.8x doesn't care too much about it, 0.9x is > more strict and refuses to start offset calculations on broken files. > It's not a big deal since such files usualy wont run. > > Your are absolutely correct. When attempting to run these files on a WinXP system, Windows returns with a dialog indicating that it's not a valid Win32 Executable..
Thanks for clearing this up. Much appreciated! Joe _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
