Re: [Clamav-users] Unofficial Phishing Signatures

2006-01-25 Thread Jason Haar
Dennis Peterson wrote: What methodology are you using to create these? It looks like an opportunity for collaboration if there's a way to avoid dupes. If signature development is truly getting bogged down, perhaps more official people are needed? I guess we'd hear a call for volunteers if

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Erik Corry
On Tue, Jan 24, 2006 at 06:40:12PM -0500, Mike Robinson wrote: I've tried submitting a new Mytob variant over the last 2 days (still not being detected by ClamAV) and I've still not got a responseI The following signature seems to detec the Mytob variants on my system:

[Clamav-users] mywife virus catched by webshield but not by clamav

2006-01-25 Thread Chavez Gutierrez, Freddy
Hi all. I have a question about the MyWife virus. Regarding to this, i found the next: Author: Tomasz Papszun Date: 2004-09-09 04:23 -500 To: clamav-users Subject: Re: [Clamav-users] Virus with p0rn picture attachment? The detection for this was added in ClamAV on Monday 2004.09.06 16:53 GMT as

[Clamav-users] FAQs

2006-01-25 Thread G.W. Haywood
Hi folks, Why are there two almost completely different FAQs? http://www.clamav.net/doc/0.88/html/node46.html http://www.clamav.net/faq.html 73, Ged. ___ http://lurker.clamav.net/list/clamav-users.html

[Clamav-users] Re: FAQs

2006-01-25 Thread G.W. Haywood
Hello again. On Wed, 25 Jan 2006, G.W. Haywood wrote: Why are there two almost completely different FAQs? http://www.clamav.net/doc/0.88/html/node46.html http://www.clamav.net/faq.html Sorry, not two. Three. http://wiki.clamav.net/index.php/FrequentlyAskedQuestions 73, Ged.

Re: [Clamav-users] Scanning and eml file

2006-01-25 Thread Cristiano Paris
Daniel J McDonald wrote: On Tue, 2006-01-24 at 22:21 +0100, Cristiano Paris wrote: Sorry to post what is likely to be a silly question. I've just installed 0.88 version of clamav and I'm seeking to test it out. I'm using an email I've received: I've saved the mail to an eml file that I

Re: [Clamav-users] Unofficial Phishing Signatures

2006-01-25 Thread Mike Robinson
Jason Haar wrote: Dennis Peterson wrote: What methodology are you using to create these? It looks like an opportunity for collaboration if there's a way to avoid dupes. If signature development is truly getting bogged down, perhaps more official people are needed? I guess we'd

Re: [Clamav-users] Unofficial Phishing Signatures

2006-01-25 Thread Todd Lyons
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Jan 24, 2006 at 08:49:03PM +, Steve Basford wrote: Note 2: Use the unofficial phish.ndb at your own risk. Any reason to call it phish.ndb instead of phish.db? Just a way to make automating it easier? - -- Regards... Todd

Re: [Clamav-users] Unofficial Phishing Signatures

2006-01-25 Thread Steve Basford
Todd Lyons wrote: Any reason to call it phish.ndb instead of phish.db? Just a way to make automating it easier? Hi Todd, If you look at the current signature pdf docs here: http://www.clamav.net/doc/0.88/signatures.pdf If you look at Section 3.3 (Basic Signature format) you'll see that

Re: [Clamav-users] Unofficial Phishing Signatures

2006-01-25 Thread Todd Lyons
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, Jan 25, 2006 at 06:40:37PM +, Steve Basford wrote: If you look at Section 3.3 (Basic Signature format) you'll see that these databases are .db format, which doesn't have a html type, it looks for matches in ALL file types, which I

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Erik Corry
On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote: Erik Corry wrote: The following signature seems to detec the Mytob variants on my system: Suspicious.HTML.javascript2=756e6573636170652822253636 Put it in a file called local.db in the same directory as your main.cvd and

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Diego d'Ambra
Erik Corry wrote: On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote: Erik Corry wrote: The following signature seems to detec the Mytob variants on my system: Suspicious.HTML.javascript2=756e6573636170652822253636 Put it in a file called local.db in the same

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Diego d'Ambra
Erik Corry wrote: On Tue, Jan 24, 2006 at 06:40:12PM -0500, Mike Robinson wrote: I've tried submitting a new Mytob variant over the last 2 days (still not being detected by ClamAV) and I've still not got a responseI The following signature seems to detec the Mytob variants on my system:

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Mike Robinson
Diego d'Ambra wrote: Erik Corry wrote: On Wed, Jan 25, 2006 at 01:19:58PM -0500, Mike Robinson wrote: Erik Corry wrote: The following signature seems to detec the Mytob variants on my system: Suspicious.HTML.javascript2=756e6573636170652822253636 Put it in a file

Re: [Clamav-users] No response to virus submissions...

2006-01-25 Thread Erik Corry
On Wed, Jan 25, 2006 at 09:55:10PM +0100, Diego d'Ambra wrote: Erik Corry wrote: Suspicious.HTML.javascript2=756e6573636170652822253636 Put it in a file called local.db in the same directory as your main.cvd and daily.cvd files. It searches for the string: unescape (%66 (only