[sanesecurity] Re: False Positive?

  • From: "Steve Basford" <steveb_clamav@xxxxxxxxxxxxxxxx>
  • To: sanesecurity@xxxxxxxxxxxxx
  • Date: Fri, 30 Oct 2009 08:18:19 -0000 (GMT)

> Ok, I need a bit of help here.  I have had a couple of messages blocked
> because of this signature.  I decoded it, but the result doesn't make
> sense other than the word Halloween is in it. The message has the word
> Halloween in it plus a link to some images stored at www {dot} wtv
> {dash} zone {dot} com {slash} angleimage.

Hi Lyle,

Thanks for the report... I've removed the sig... and mirrors updated.

> False positive maybe?  Maybe someone could tell me how to read that
> signature...

A simple decoder is here, but it does decode 100%:


If anyone could code a proper sig decoder for the web, that would be great :)



Other related posts: