[clamav-users] Rule for false extension rtf

[Virgo Pärna]

	Lately there have been several malware rtf files with doc
extension, that I have received by e-mail and that are not immediately
recognized by clamav. From virustotal scan they appear to be RTF bug
exploits.
	Since clamav has special type support for rtf, would it be
possible to write custom rule to block rtf files with doc extension?

-- 
Virgo Pärna 
irgo.parna at mail.ee