Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Ian Eiloart
--On 19 January 2011 14:56:54 +0200 Török Edwin wrote: On 2011-01-19 14:28, Ian Eiloart wrote: Hi, I'm getting a lot of reports of "BC.PDF.Producer.JSHIP FOUND" in the logs for my outbound mail stream today. This signature seems to be matching every email sent with a PDF file attached. S

Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Ian Eiloart
--On 19 January 2011 17:26:40 +0200 Török Edwin wrote: Given that I got dozens of FPs in few minutes, The bug depends on /Producer, so if one of your PDF triggers the bug, all PDFs created by same app will probably trigger same bug. it hardly seems you need a "special" test case. W

Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Török Edwin
On 2011-01-20 13:49, Ian Eiloart wrote: > > > --On 19 January 2011 17:26:40 +0200 Török Edwin > wrote: > >> >>> Given that I got dozens of FPs in >>> few minutes, >> >> The bug depends on /Producer, so if one of your PDF triggers the bug, >> all PDFs created by same app will probably trigger sa

Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Alessio Cassibba (X-Drum)
2011/1/20 Ian Eiloart wrote: > I've seen the bug with three different producers, I think: Word 2007, Adobe > PDF Library 9.9 (Adobe InDesign CS5 (7.0)) and something from Oracle. I > don't know who or what JSHIP is. > > However, I've now switched PDF scanning back on, with bytecode version 122, > a

Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Török Edwin
On 2011-01-20 16:37, Alessio Cassibba (X-Drum) wrote: > 2011/1/20 Ian Eiloart wrote: >> I've seen the bug with three different producers, I think: Word 2007, Adobe >> PDF Library 9.9 (Adobe InDesign CS5 (7.0)) and something from Oracle. I >> don't know who or what JSHIP is. >> >> However, I've now

Re: [clamav-users] BC.PDF.Producer.JSHIP

2011-01-20 Thread Alessio Cassibba (X-Drum)
On 2011/1/20 Török Edwin wrote: > > So you still got the FP with v122? > Yes still with v122. > > Yes please send it to me (edwin at clamav dot net). > Scan log sent, hope this helps. ___ Help us build a comprehensive ClamAV guide: visit http://wiki.cla