[clamav-users] FP-Report: Email.Trojan-417

[Steve Basford]

On Tue, May 13, 2014 8:27 am, Julian Hansmann wrote:

> Regardless of its content (even if it's empty) a mail which has a file
> with the suffix ".JPG.zip" (case sensitive) attached will be detected as
> "Email.Trojan-417".
>
Hi Julian,

I'm guessing the orignal offical signature was to catch something like this:

http://techhelplist.com/index.php/spam-list/421-do-you-think-i-m-attractive-virus

You can whitelist in your setup, while you wait for an offical response:

printf "Email.Trojan-417" > ignore.ign2
copy the ignore.ign2 file into your clamav database directory
restart clamd


Cheers,

Steve
Sanesecurity