[clamav-users] FP-Report: Email.Trojan-417

[Al Varnell]

On Thu, May 15, 2014 at 12:04 AM, Julian Hansmann wrote:
> thank your very much for your responses. I added the signatures name
> to the whitelist which works flawless.

The signature was removed almost immediately after the announcement, so you should no longer need the whitelist.

> I can see that sending an attachment with an double extension is
> somehow sensless and suspicious however I think you can't take that as
> a virus. We're using ClamAV for all our e-mail customers and we do
> enforce quite strict policies when it comes to viruses. That's why
> this fp caused some trouble.
> 
> Do you lists fp removals in your database update mails?

I have never seen a removal listed.


-Al-
-- 
Al Varnell
Mountain View, CA