[clamav-users] False Positive - Win.Exploit.CVE_2016_3316-1?

[Steve Basford]

On Wed, August 10, 2016 10:52 am, Jan-Pieter Cornet wrote:
> On 10-8-16 08:22, ANANT S ATHAVALE wrote:
>
>> Hi,
>>
>>
>> Most of the mails are marked with  Win.Exploit.CVE_2016_3316-1.  Is
>> this a false positive?
>
> Created a completely empty .doc file using LibreOffice on linux, and the
> resulting file was recognized as Win.Exploit.CVE_2016_3316-1.
>
If you have a sample could you throw me a copy, as I've created a few
blank files on libreoffice and scanned with clamav and no hits.

create a ticket and upload:

http://sanesecurity.org/hesk/

If it is an fp, then I've like to add this "blank" file to my ham folder
so Sanesecurity sigs won't hit in the future either.

Cheers,

Steve
Web : sanesecurity.com
Twitter: @sanesecurity