Re: [clamav-users] Malwarepatrol false positive

2018-08-27 Thread lukn
Hi cudasvc was recently listed on Spamhaus' DBL. Looks like Barracuda has some kind of issues with their service. The other question is, why do people use such link cloakers? On 27.08.2018 22:44, Mark G Thomas wrote: > Hi, > > But, there are more. This is nuts. > > # sigtool --find-sigs

Re: [clamav-users] Malwarepatrol false positive

2018-08-27 Thread Mark G Thomas
Hi, But, there are more. This is nuts. # sigtool --find-sigs MBL_13112740 | sigtool --decode-sigs VIRUS NAME: MBL_13112740 DECODED SIGNATURE: https://linkprotect.cudasvc.com/url Mark On Mon, Aug 27, 2018 at 07:41:27PM +0100, Steve Basford wrote: > Just whitelisted for those

Re: [clamav-users] Malwarepatrol false positive

2018-08-27 Thread Steve Basford
Just whitelisted for those using download scripts.. using the ign2 file on the Sanesecurity mirrors. Cheers, Steve Twitter: @sanesecurity On 27 August 2018 19:16:49 Mark G Thomas wrote: Hi, This seems to be an ongoing trend. I can't believe someone thought this would be a good idea! #

Re: [clamav-users] Malwarepatrol false positive

2018-08-27 Thread Mark G Thomas
Hi, This seems to be an ongoing trend. I can't believe someone thought this would be a good idea! # sigtool --find-sigs MBL_13087222 | sigtool --decode-sigs VIRUS NAME: MBL_13087222 DECODED SIGNATURE: https://docs.google.com On Tue, Aug 21, 2018 at 04:31:28AM -0700, Al Varnell

Re: [clamav-users] FP Heuristics.Phishing.Email.SpoofedDomain with amazon

2018-08-27 Thread Reindl Harald
Am 23.08.2018 um 20:08 schrieb Marcus Schopen: > Hi, > > Am Dienstag, den 14.11.2017, 11:20 +0100 schrieb Hajo Locke: >> Hello, >> >> based on my working whitelist regex i would say the 2nd part should >> not >> look only for amazon\.com >> >> >> If i understood it the correct way it should