Re: [Clamav-users] Word Vulnerability

2006-05-23 Thread Rob MacGregor
On 5/24/06, Kevin W. Gagel <[EMAIL PROTECTED]> wrote: - Original Message - >Can someone clarify whether(and I'm hoping *grin*) that the >latest Word vulnerability is detectable by ClamAV? Or >better yet, can someone point out what the other AV >companies named this type of rootkit/trojan

Re: [Clamav-users] Word Vulnerability

2006-05-23 Thread Kevin W. Gagel
- Original Message - >Can someone clarify whether(and I'm hoping *grin*) that the >latest Word vulnerability is detectable by ClamAV? Or >better yet, can someone point out what the other AV >companies named this type of rootkit/trojan? Sans has this info on it with links to eye and ms sit

[Clamav-users] Word Vulnerability

2006-05-23 Thread cc
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Can someone clarify whether(and I'm hoping *grin*) that the latest Word vulnerability is detectable by ClamAV? Or better yet, can someone point out what the other AV companies named this type of rootkit/trojan? Thanks -BEGIN PGP SIGNATURE--

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Alex Georgopoulos
On 5/23/06, Jan Pieter Cornet <[EMAIL PROTECTED]> wrote: On Tue, May 23, 2006 at 02:06:05PM -0600, Alex Georgopoulos wrote: > Tons maybe a little exaggerated but like Kelson said the users keep retrying > cause they don't get any notification that it is getting blocked so the send > it again. R

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
On Tue, May 23, 2006 at 02:06:05PM -0600, Alex Georgopoulos wrote: > Tons maybe a little exaggerated but like Kelson said the users keep retrying > cause they don't get any notification that it is getting blocked so the send > it again. Removing the def from the cvd file is an option but would be

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
On Tue, May 23, 2006 at 12:49:50PM -0700, Kelson wrote: > Jan Pieter Cornet wrote: > >Maybe "tons" is slightly exaggerated? Out of approximately 10 million > >emails today, our logs show one hit for XF.Sic.L, and then another hit > >when that email was bounced because of the reject we gave. > > If

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Alex Georgopoulos
On 5/23/06, Kelson <[EMAIL PROTECTED]> wrote: Jan Pieter Cornet wrote: > Maybe "tons" is slightly exaggerated? Out of approximately 10 million > emails today, our logs show one hit for XF.Sic.L, and then another hit > when that email was bounced because of the reject we gave. If their customer

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Kelson
Jan Pieter Cornet wrote: Maybe "tons" is slightly exaggerated? Out of approximately 10 million emails today, our logs show one hit for XF.Sic.L, and then another hit when that email was bounced because of the reject we gave. If their customer is trying repeatedly to send "a bunch" of files that

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
On Tue, May 23, 2006 at 11:36:12AM -0600, Alex Georgopoulos wrote: > First I would like to say I've submitted files via the web interface with > the false positive using the method from the FAQ. I have a bunch of excel > files that won't get through because clam thinks it has this W97 macro > viru

[Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Alex Georgopoulos
First I would like to say I've submitted files via the web interface with the false positive using the method from the FAQ. I have a bunch of excel files that won't get through because clam thinks it has this W97 macro virus. We have had 3 commercial AV vendors analyze this file and they said it