[clamav-users] Probable false positive *.xlsm - Win.Trojan.Toa-5368540-0

[Steve basford]

#All# macros inside xlsm files are being blocked due to sig blocking of 
Vbaproject.bin inside.

Cheers,

Steve
Twitter: @sanesecurity



On 27 December 2016 20:08:37 Adnan de Castro Donato 
<adnan.castro at stwbrasil.com> wrote:

>
> In keeping with one false positive reports
> I have 8 CentOS servers report below after Signatures Published daily - 
> 22782 update:
>
> All attachment with extension *.xlsm have the same issue:
>
> Our content checker found
>     virus: Win.Trojan.Toa-5368540-0
>
>
> Believe this is a false positive  Would like confirmation and an update if 
> possible
>
> Thanks.
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml