Re: [clamav-users] Limitation or bug in ClamAV's processing of Yara rules?

[Kris Deugau]

G.W. Haywood wrote:

Hi Kris,

On Thu, 15 Mar 2018, Kris Deugau wrote:


I'm still chasing signatures for a certain class of (very) oversized
spam with malformed HTML. ...


Would you be able to send me a few samples?  Preferably with full headers.


I've been able to create logical (.ldb) variant signatures for nearly 
all of the examples I've had reported thanks to suggestions from Steve 
Basford, so I can't email them as the message would be blocked by our 
outgoing AV scan...


So I've posted a .zip on my web space with four (small) more or less 
representative examples of the class.  Please note the full set of 
variations cover, essentially, "long strings of symbols in the 

Re: [clamav-users] Question about the clamdscan

[Tsutomu Oyamada]

Thank you so much.
Your advice was very helpful.
I would also like to wait for a message from the developer.

On Thu, 15 Mar 2018 23:13:09 -0700
Al Varnell  wrote:

> I believe the developers are hard at work planning for the future this week, 
> so they can probably can give you better answers than I later on.
> 
> I suspect some of this may be platform specific, so my answers are based on 
> my macOS experience.
> 
> clamd scans every file that clamdscan tells it to, so something else needs to 
> keep track of what's new or changed and notify clamdscan to tell clamd to 
> scan them. So that requires tapping into the file system to determine changes 
> in the area of interest.
> 
> I've never had an issue with using a file while it's being processed by 
> ClamAV, but scans normally take place very rapidly, so I my not have noticed 
> it being locked.
> 
> Sent from my iPad
> 
> -Al-
> 
> > On Mar 15, 2018, at 1:12 AM, Tsutomu Oyamada  
> > wrote:
> > 
> > I have two question about the clamdscan;
> > 
> > 1) Does the clamd skip scanning the files which are scanned before?
> > I want to know if the clamd remember which files are scanned, and skip them 
> > when the scan is performed again.
> > 
> > 2) Is there any case that a file is locked by the clamd  (user cannot use 
> > that file) during that is scanned?
> > 
> > T.O
> ___
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml


___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml