[clamav-users] Same file, different signatures detected

[Albrecht, Peter]

Hi,

We have whitelisted certain signatures for files which are only detected by
ClamAV to be potentially malicious. And now we face the problem that the
same files are reported again, but with a different signature. I already had 
this behaviour when I tested with the EICAR test virus.

The signatures in question are now:

Html.Malware.Agent-6625344-0 (whitelisted already)
Html.Malware.Agent-6625164-0 (new signature for the same files)

After whitelisting the latter one, ClamAV comes again with a new signature:

Html.Malware.Agent-6625283-0

It looks like there are multiple signatures defined for the same file. What
would you need from me to investigate further?

We are using ClamAV 0.99.4 on Linux. The virus signatures are updated
directly before running clamscan.

Regards,

Peter

Peter Albrecht
Senior Linux Administrator 

Wirecard Service Technologies GmbH
Einsteinring 35 | 85609 Aschheim | Germany
Tel: +49 (0) 89 4424-191076
https://www.wirecard.com
________________________________________________________________________________________________________

Amtsgericht München HRB Nummer 238 150

Geschäftsführer: Thomas Neef, Susanne Steidl, Yiannakis Ioannou

VERTRAULICHE INFORMATIONEN! Diese E-Mail enthält vertrauliche Informationen und ist nur für den berechtigten Empfänger
bestimmt. Wenn diese E-Mail nicht für Sie bestimmt ist, bitten wir Sie, diese E-Mail an uns zurückzusenden und anschließend
auf Ihrem Computer und Mail-Server zu löschen. Solche E-Mails und Anlagen dürfen Sie weder nutzen, noch verarbeiten oder 
Dritten zugänglich machen, gleich in welcher Form. Wir danken für Ihre Kooperation!

CONFIDENTIAL! This email contains confidential information and is intended for the authorized recipient only. If you are 
not an authorised recipient please return the email to us and then delete it from your computer and mail-server. You may neither 
use nor edit any such emails including attachments, nor make them accessible to third parties in any manner whatsoever. 
Thank you for your cooperation.