[clamav-users] winnow FP

[Al Varnell]

I don’t think you are in the right place as I can’t find that signature (or any remotely resembling it) in the ClamAV official database.  I suspect you are using some 3rd party UNOFFICIAL signatures that are detecting that one.

-Al-

On Wed, Apr 13, 2016 at 08:20 AM, Alex wrote:
> 
> Hi,
> 
> I don't understand why themastersbaker.com would be tagged?
> 
> # sigtool --find-sigs winnow.spam.ts.untyped.966134 | sigtool --decode-sigs
> VIRUS NAME: winnow.spam.ts.untyped.966134
> TARGET TYPE: MAIL
> OFFSET: *
> DECODED SIGNATURE:
> http://themastersbaker.com/
> 
> 
> This isn't currently on any other blacklist. Is this the proper
> address to request a winnow removal?
> 
> I've already whitelisted it.
> Thanks,
> Alex
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2370 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20160413/2e8e214d/attachment.bin>