[clamav-users] False Positive - Win.Exploit.CVE_2016_3316-1?
steveb_clamav at sanesecurity.com
Wed Aug 10 06:05:44 EDT 2016
On Wed, August 10, 2016 10:52 am, Jan-Pieter Cornet wrote:
> On 10-8-16 08:22, ANANT S ATHAVALE wrote:
>> Most of the mails are marked with Win.Exploit.CVE_2016_3316-1. Is
>> this a false positive?
> Created a completely empty .doc file using LibreOffice on linux, and the
> resulting file was recognized as Win.Exploit.CVE_2016_3316-1.
If you have a sample could you throw me a copy, as I've created a few
blank files on libreoffice and scanned with clamav and no hits.
create a ticket and upload:
If it is an fp, then I've like to add this "blank" file to my ham folder
so Sanesecurity sigs won't hit in the future either.
Web : sanesecurity.com
More information about the clamav-users