I hate having to point this out, but... When Alain notified the list that the signature had been dropped on July 25, 2016 at 8:12:21 AM PDT, daily:21968 had just be published.
It wasn’t until daily:21975 that the following appeared with the first dropped entry: > ClamAV Signature Publishing Notice > > Datefile: daily > Version: 21975 > Publisher: Alain Zidouemba > New Sigs: 119 > Dropped Sigs: 1 > Ignored Sigs: 33 <snip> > Dropped Detection Signatures: > > > * Xml.Exploit.CVE_2013_3860-1 When I checked before this update the signature was still present on the ClamAV Virus Signature Search site. When I checked shortly after this update it was gone. So that would seem to make it a total of seven update cycles before it was actually dropped. And that still doesn’t explain why three days went by between daily:21954 and daily:21971 (eighteen cycles) with identical updates of: > ClamAV Signature Publishing Notice > > Datefile: daily > Version: 21971 > Publisher: Alain Zidouemba > New Sigs: 0 > Dropped Sigs: 0 > Ignored Sigs: 33 > > > New Detection Signatures: > > > > Dropped Detection Signatures: > But that question was asked in a different thread by a different user. -Al- On Tue, Jul 26, 2016 at 07:27 PM, Joel Esler (jesler) wrote: > > It may take more than one publish cycle to drop a sig. Publish cycles are at > least every four hours. > > -- > Joel Esler > iPhone > > On Jul 26, 2016, at 10:16 PM, Al Varnell > <alvarn...@mac.com<mailto:alvarn...@mac.com>> wrote: > > Appears to be finally gone at this time. > <http://clamav-du.securesites.net/cgi-bin/clamgrok?virus=Xml.Exploit.CVE_2013_3860-1&search-type=contains&case-sensitivity=No&database=daily&database=main&display=database&display=virus&display=signature&.submit=Submit&.cgifields=database&.cgifields=search-type&.cgifields=case-sensitivity&.cgifields=display> > > -Al-
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
