Hello,
Could you replace the line with this and re-scan:
Sanesecurity.EvilJS.1:3:*:2E63686172617428{-3}293b{-20}2e7265706c61636528{-2}2f672c{-30}3d756e65736361706528{-70}3b646f63756d656e742e777269746528
Steve Sanesecurity
yes, thanks, this works. i tested with different accounts and correct files were found. we can stop now this stuff by mod_clamav for proftpd directly whren it is uploaded.
Thank you, Andre
