On Mon, 2007-10-08 at 16:25 -0300, Joao S Veiga wrote:
> > Of course. However, I got the impression that neither of the recent
> > reporters does this additional step. Also, this gets even more annoying
> > (and maybe impossible) when dealing with PST files (which one of the OPs
> > does).
>
> Hi, if one of those reporters is me, I don't "advocate" doing what I do. I
> was
> justifying why I do it :-). [...]
Indeed, you are. :-)
Sorry, if that came out wrong. I'm not a native English speaker, and
didn't mean to accuse you or anyone for that matter.
The mentioned procedure of re-scanning after delivery does bear some
pitfalls. Which in both these cases led to false alarms. Since it seems
to be practice anyway, one needs to be aware of potential issues. That
is all I was aiming for: Pointing out the issues, raising awareness.
> In the FreeGame case, I just removed the signature from daily.ndb.
Which, at the point of your OP and as mentioned in the previous thread,
has been done upstream already. :)
> I just replied to a guy who had the same false alarm as me, since I already
> had
> found the workaround (and had submitted the sample false positive file). Then
> the
> wrath of heavens broke down on me.
Err, no, you did not reply, but start a new thread.
Anyway, pointing out issues (as you did) and submitting FP samples
always is appreciated. :)
guenther
--
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
