On 2011-03-31 10:22, kshitij mali wrote: > Hi All , > > > I am using postfix with amavisd-new for mail gateway > > where amavid-new it using clamd for scanning email and has the flase postive > it alway block the email attachment which containing virus XF.Sic.L and > XF.Sic.E virus , where actually it is not an virus .
Are you sure? The signature contains "Infect Workbook" among others. See: sigtool -f XF.Sic.E|sigtool --decode-sigs sigtool -f XF.Sic.L|sigtool --decode-sigs > > Please tell me how to overcome this false postive. If you're sure it is a FP, then submit it at clamav.net/sendvirus, and mark it as a false positive. Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
