Re: [clamav-users] PUA.PDF.OpenActionObject too broad

2011-04-24 Thread Steven Chamberlain
On -10/01/37 20:59, Johannes Schulz wrote: > "sigtool -fPUA.PDF.OpenActionObject|sigtool --decode-sigs" says: > VIRUS NAME: PUA.PDF.OpenActionObject > TARGET TYPE: ANY FILE > OFFSET: 0 > DECODED SIGNATURE: > %PDF-{WILDCARD_ANY_STRING}obj{WILDCARD_ANY_STRING(LENGTH<=2)}<<{WILDCARD_ANY_STRING}/OpenAc

[clamav-users] [Clamav-users] PUA.PDF.OpenActionObject too broad

2011-04-24 Thread Johannes Schulz
"sigtool -fPUA.PDF.OpenActionObject|sigtool --decode-sigs" says: VIRUS NAME: PUA.PDF.OpenActionObject TARGET TYPE: ANY FILE OFFSET: 0 DECODED SIGNATURE: %PDF-{WILDCARD_ANY_STRING}obj{WILDCARD_ANY_STRING(LENGTH<=2)}<<{WILDCARD_ANY_STRING}/OpenAction /OpenAction comes in two variants - the PDF Refe