Hi-- On May 13, 2013, at 9:47 AM, Lee Graber <l...@highspot.com> wrote: > I am investigating a document which seems to be getting flagged by clamav > as having a virus but I am not sure this is accurate. It is actually a > document about a virus and I am wondering if there is something in it that > perhaps describes the virus and so is getting flagged. > > The file can be downloaded from: > http://www.findthatdoc.com/search-14170003-hPDF/download-documents-2001-09-19-analysis-nimda-pdf.htm
The original PDF is kept at: http://slug.ceca.utc.edu/docs/2001-09-19_Analysis_Nimda.pdf ClamAV's clamscan identifies it as: 2001-09-19_Analysis_Nimda.pdf: Exploit.IFrame.Gen FOUND That's likely to be a false positive, as only ClamAV is reporting a match per virustotal site: https://www.virustotal.com/en/file/54ec02e55244acdf0170aa1790ae250d5740d0b13c7ba8214614b77f7e07e41b/analysis/1368471029/ Regards, -- -Chuck _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
