2011/3/31 Török Edwin <email@example.com>
> On 2011-03-31 10:22, kshitij mali wrote:
> > Hi All ,
> > I am using postfix with amavisd-new for mail gateway
> > where amavid-new it using clamd for scanning email and has the flase
> > it alway block the email attachment which containing virus XF.Sic.L and
> > XF.Sic.E virus , where actually it is not an virus .
> Are you sure? The signature contains "Infect Workbook" among others.
> sigtool -f XF.Sic.E|sigtool --decode-sigs
> sigtool -f XF.Sic.L|sigtool --decode-sigs
> > Please tell me how to overcome this false postive.
> If you're sure it is a FP, then submit it at clamav.net/sendvirus, and
> mark it as a false positive.
> Best regards,
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://www.clamav.net/support/ml >