Two scanners, two different virus names, which one is chosen?

[Ralf Hildebrandt]

>From my log:
============

May 25 14:56:47 mail2 amavis[25873]: (25873-14) virus_scan: (W32.Trojan.Inject-8), detected by 2 scanners: ClamAV-clamd, AVG Anti-Virus

I then scanned the file with both clam & avg on the box:

# clamscan Lieferschein.exe 
Lieferschein.exe: W32.Trojan.Inject-8 FOUND

# avgscan Lieferschein.exe
...
Lieferschein.exe  Trojan horse Delf.AEJO

So the two scanners are recognizing the same virus under different
names. That's to be expected.

But: If I were to create an exception (maybe due to a false positive in clamav
-- which has happened quite a bit recently! -- I'd be hard pressed to
find out WHICH virus(name) was recognized by WHICH scanner!

Wouldn't something like:

virus_scan: [W32.Trojan.Inject-8, Trojan horse Delf.AEJO], detected by 2 scanners: [ClamAV-clamd, AVG Anti-Virus]

be better (the 1st name in the list first list corresponds to the
first scanner in the second list)?

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
http://www.charite.de              Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155