Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
Robert S wrote: > Office 2000 Pro CD 1. . it gets reported as being infected thus: There are some people who think the same thing :) Matt ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
On Tue, 21 Dec 2004 07:32:08 +1100 "Robert S" <[EMAIL PROTECTED]> wrote: > I'm using samba + vscan-clamav. I've recently created an iso image of > MS Office 2000 Pro CD 1. When I try to copy it to my samba/clam > server it gets reported as being infected thus: > > smbd_vscan-clamav[22858]: ALERT - Scan result: '/pub/CDImages/Office > 2000 CD1.iso' infected with virus 'Exploit.IFrame.Gen' > > I assume that the iso file contains the same signature as the virus. Read the archives. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Mon Dec 20 21:38:54 CET 2004 pgpiAjT39452e.pgp Description: PGP signature ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
On Tue, 21 Dec 2004 at 7:32:08 +1100, Robert S wrote: > I'm using samba + vscan-clamav. I've recently created an iso image of MS > Office 2000 Pro CD 1. When I try to copy it to my samba/clam server it gets > reported as being infected thus: > > smbd_vscan-clamav[22858]: ALERT - Scan result: '/pub/CDImages/Office 2000 > CD1.iso' infected with virus 'Exploit.IFrame.Gen' > > I assume that the iso file contains the same signature as the virus. > An updated signature will be released shortly. Then the false signature will be removed from the main.cvd. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/iso/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
Tomasz Papszun wrote: On Tue, 21 Dec 2004 at 7:32:08 +1100, Robert S wrote: I'm using samba + vscan-clamav. I've recently created an iso image of MS Office 2000 Pro CD 1. When I try to copy it to my samba/clam server it gets reported as being infected thus: smbd_vscan-clamav[22858]: ALERT - Scan result: '/pub/CDImages/Office 2000 CD1.iso' infected with virus 'Exploit.IFrame.Gen' I must say that I think it's a bad idea to be allowing on-line scanners to scan ISO images. clamscan took over 7 min to scan a Knoppix ISO I have - I can't imagine that "drag and dropping" a 700M file onto a Samba server and having it HANG for 7+ minutes before finishing the write would be acceptable to most people. In fact, none of the commercial on-line Windows scanners I've used would ever scan such a large file - they all have sanity cutoffs of (say) 20M filesizes before they give up. Unless you have such an option, you are opening your file server up to DoS attacks (i.e. drop the same ISO 5 times onto the server and watch your server hit 100% CPU). Does vscan for Samba have such an "max filesize" option? (I don't use it myself). If it doesn't, it probably should... -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
[EMAIL PROTECTED] wrote: danke fÃr deine eamil OK this is getting *REALLY* annoying. -Jim ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: [Clamav-users] clam reports MS Office 2000 Pro CD 1 as infected
danke fÃr deine eamil ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
