On Mon, 27 Feb 2006 16:50:50 -0800 "Bill Landry" <[EMAIL PROTECTED]> wrote:
> ----- Original Message ----- > From: "Dennis Peterson" <[EMAIL PROTECTED]> > > >> On Sun, 26 Feb 2006 15:27:57 -0800 > >> Dennis Peterson <[EMAIL PROTECTED]> wrote: > >> > >> > The follow-up. Steve - your list found over 3,000 Phishing attempts > >> > while= > >> the=20 > >> > ClamAV list found just over 300. This is since Feb. 2. I didn't expect > >> > th= > >> at.=20 > >> > Thanks, bud! > >> > >> BTW, how do you make the stats? Do you run two seperate clamd > >> instances, one with official databases and the other one with Steve's > >> sigs only? > >> > > > > The milter I use records the name and time of the found virus/phishing > > file > > in a table. I sort out two lists based on names. > > So, if one particular phish signature is listed in the official ClamAV > database, and is also listed in the user maintained database (phish.ndb), > which one take listing precedence when the message is flagged and logged, > the official sig entry or the user maintained sig entry? There is no rule because ClamAV treats all loaded signatures with the same priority. That's why doing such stats with a single clamd instance may lead to false results. -- oo ..... Tomasz Kojm <[EMAIL PROTECTED]> (\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg \..........._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Tue Feb 28 02:00:15 CET 2006
signature.asc
Description: PGP signature
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
