[clamav-users] Whitelisting whole domains (Re: Heuristics.Phishing.Email.SpoofedDomain again)

Kris Deugau wrote: > How do I whitelist all combinations of TLD 1 and TLD 2 with/without > subdomains in one entry? > > I've just had a series of FP reports, all appear to be triggered by a > Scotiabank internal mail system URL that shows scotiabank.com (with a > host/subdomain in some messages, w

Re: [clamav-users] Clamscan infection that is not infected

Oh, sorry, didn’t see that Alain wrote this. Apologies. > On Apr 15, 2015, at 9:52 AM, Alain Zidouemba > wrote: > > Can you provide a checksum for your sample? > > Thanks, > > - Alain > > On Wed, Apr 15, 2015 at 9:50 AM, sanes wrote: > >> Why does clamscan show this file infection, but a

Re: [clamav-users] Clamscan infection that is not infected

On Apr 15, 2015, at 9:50 AM, sanes mailto:z...@wrzanes.com>> wrote: Why does clamscan show this file infection, but a scan with VirusTotal.com shows file is safe? Which source should I trust? c:\Windows\System32\mobsync.exe: Win.Trojan.Agent-863936 FOUND If you belie

Re: [clamav-users] Clamscan infection that is not infected

Can you provide a checksum for your sample? Thanks, - Alain On Wed, Apr 15, 2015 at 9:50 AM, sanes wrote: > Why does clamscan show this file infection, but a scan with VirusTotal.com > shows file is safe? Which source should I trust? > > c:\Windows\System32\mobsync.exe: Win.Trojan.Agent-86393

[clamav-users] Clamscan infection that is not infected

Why does clamscan show this file infection, but a scan with VirusTotal.com shows file is safe? Which source should I trust? c:\Windows\System32\mobsync.exe: Win.Trojan.Agent-863936 FOUND ___ Help us build a comprehensive ClamAV guide: https://github.c