[clamav-users] False Positive for BC.Exploit.CVE_2012_1885-1

2012-12-10 Thread Matthias Egger
Hello List I have a zip file containing a .pptx file which ClamAV claims to be "BC.Exploit.CVE_2012_1885-1". But virustotal and virscan.org have no complain at all. https://www.virustotal.com/file/09c5de164928c88b6ee370677242a4d69a00a88ecbd044af656f17fc54665fea/analysis/1355131094/ http://r.

Re: [clamav-users] False Positive for BC.Exploit.CVE_2012_1885-1

2012-12-10 Thread David Raynor
It is not the CVD files. The versions you list are the same versions as we have up to date [and the daily.cvd is 15708]. I'd wager there is some kind of non-default scan option that is changing the results. So let's try the easiest one first: how big is the file? If you have raised it past the fil