Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Rob MacGregor
On Mon, 21 Mar 2005 17:01:48 -0400, Samuel Benzaquen [EMAIL PROTECTED] wrote: I can also say that they don't want to compete against commercial AV vendors as I have read here 2^32 times that we should use not _only_ clamav, but a list of AVs to improve the chances to catch malware. Best

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Dennis Davis
On Tue, 22 Mar 2005, Rob MacGregor wrote: From: Rob MacGregor [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 09:58:17 + Subject: Re: [Clamav-users] Report Phishing attacks? Reply-To: ClamAV users ML clamav-users@lists.clamav.net On Mon, 21

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Tomasz Papszun
On Mon, 21 Mar 2005 at 12:47:54 -0600, Sam wrote: How does one go about getting the text for JS.Scramble to put into the user.db file? Is there a location for strings that have been pulled out? If you mean JS.Spam.Scramble.A, please find it attached. Disclaimer: use it at your own risk.

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 21, 2005, at 5:10 PM, Brian Morrison wrote: On Mon, 21 Mar 2005 20:06:02 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: Brian Morrison wrote: Julian Mehnle wrote: Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 6:35 AM, Dennis Davis wrote: On Tue, 22 Mar 2005, Rob MacGregor wrote: From: Rob MacGregor [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 09:58:17 + Subject: Re: [Clamav-users] Report Phishing attacks? Reply-To: ClamAV users ML

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 4:58 AM, Rob MacGregor wrote: On Mon, 21 Mar 2005 17:01:48 -0400, Samuel Benzaquen [EMAIL PROTECTED] wrote: I can also say that they don't want to compete against commercial AV vendors as I have read here 2^32 times that we should use not _only_ clamav, but a list of AVs to

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Dennis Davis
On Tue, 22 Mar 2005, Bart Silverstrim wrote: From: Bart Silverstrim [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 07:40:18 -0500 Subject: Re: [Clamav-users] Report Phishing attacks? ... I believe this is what the commercial anti-virus company

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Sam
On Tue, 22 Mar 2005, Tomasz Papszun wrote: On Mon, 21 Mar 2005 at 12:47:54 -0600, Sam wrote: How does one go about getting the text for JS.Scramble to put into the user.db file? Is there a location for strings that have been pulled out? If you mean JS.Spam.Scramble.A, please find

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread BitFuzzy
Bart Silverstrim wrote: Personally, my gripe is that the product is called ClamAV. If it's expanding it's mission to protect people from everything called malware, I'd change the name to something that indicates it's a malware detector and not a virus detector. Phishing scams are *not*

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 8:05 AM, Dennis Davis wrote: On Tue, 22 Mar 2005, Bart Silverstrim wrote: From: Bart Silverstrim [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 07:40:18 -0500 Subject: Re: [Clamav-users] Report Phishing attacks? ... I believe

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 9:43 AM, BitFuzzy wrote: Bart Silverstrim wrote: Personally, my gripe is that the product is called ClamAV. If it's expanding it's mission to protect people from everything called malware, I'd change the name to something that indicates it's a malware detector and not a

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Tomasz Papszun
On Tue, 22 Mar 2005 at 8:33:09 -0600, Sam wrote: On Tue, 22 Mar 2005, Tomasz Papszun wrote: If you mean JS.Spam.Scramble.A, please find it attached. Disclaimer: use it at your own risk. Thanks Tomas! (I'm a little worried now though with your disclaimer... :) Was it just

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread BitFuzzy
Julian Mehnle wrote: I can't believe you still didn't get the point. This is NOT about removing ClamAV's capacity for detecting phishing attacks, little yellow rubber ducks in PNG images, or whatever else. This is about making it _optional_, for those people who don't want certain types of

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Ken Jones
Julian Mehnle wrote: I can't believe you still didn't get the point. This is NOT about removing ClamAV's capacity for detecting phishing attacks, little yellow rubber ducks in PNG images, or whatever else. This is about making it _optional_, for those people who don't want certain types of

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread clamav
At 06:43 AM 3/22/2005, BitFuzzy wrote: Bart Silverstrim wrote: Personally, my gripe is that the product is called ClamAV. If it's expanding it's mission to protect people from everything called malware, I'd change the name to something that indicates it's a malware detector and not a virus

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Dennis Peterson
[EMAIL PROTECTED] said: your argument isn't consistent. Paul Theodoropoulos Here we go again. dp ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread clamav
At 10:08 AM 3/22/2005, you wrote: [EMAIL PROTECTED] said: your argument isn't consistent. Paul Theodoropoulos Here we go again. Perhaps this is why it keeps coming up. An action based upon a flawed or inconsistent stance tends to do that. Why aren't we blocking Nigeria Scams? people have

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread BitFuzzy
[EMAIL PROTECTED] wrote: um, reread what you just wrote. 'any item regardless of it's delivery method that has the potential to do harm financially or otherwise'. let's see, little old ladies emailing their bank account information to MRS. MIRIAM SESE SEKO, LATE OF THE CHIEF PETROLEUM RESERVES

RE: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Matthew.van.Eerde
BitFuzzy wrote: [EMAIL PROTECTED] wrote: The difference between what's being detected as phishing attempts is that they are crafted to make you believe you are at http://www.your-bank.com, ebay.com, paypal.com, etc. They are in most cases very convincing, thus not only the foolish can fall

RE: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Julian Mehnle
BitFuzzy [EMAIL PROTECTED] wrote: The difference between what's being detected as phishing attempts is that they are crafted to make you believe you are at http://www.your-bank.com, ebay.com, paypal.com, etc. They are in most cases very convincing, thus not only the foolish can fall prey. (I

RE: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Matthew.van.Eerde
Julian Mehnle wrote: The way to combat phishing is to employ sender authentication methods such as SPF, DomainKeys, and public-key message cryptography. This is unfortunately debatable. SPF, DomainKeys, cryptography, SenderID, etc. can only work on info in the message. Nothing stops people

RE: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Julian Mehnle
Matthew van Eerde wrote: Julian Mehnle wrote: The way to combat phishing is to employ sender authentication methods such as SPF, DomainKeys, and public-key message cryptography. This is unfortunately debatable. SPF, DomainKeys, cryptography, SenderID, etc. can only work on info in the

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Daniel J McDonald
On Tue, Mar 22, 2005 at 08:49:40PM +0100, Julian Mehnle wrote: Matthew van Eerde wrote: Julian Mehnle wrote: The way to combat phishing is to employ sender authentication methods such as SPF, DomainKeys, and public-key message cryptography. This is unfortunately debatable. SPF,

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Brian Morrison
On Tue, 22 Mar 2005 19:55:38 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: The way to combat phishing is to employ sender authentication methods such as SPF, DomainKeys, and public-key message cryptography. SPF is not a good way to do this, it does practically nothing to

RE: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Julian Mehnle
Daniel J McDonald wrote: Julian Mehnle wrote: Matthew van Eerde wrote: Nothing stops people from registering a domain like onlinebanking.example and then sending out - perfectly legitimately - from [EMAIL PROTECTED] Still the sender is not @citibank.com. But I could form a

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Trog
On Sun, 2005-03-20 at 11:03 -0500, Robert Stampfli wrote: My question: Does the ClamAV team want examples of these phishing emails submitted to them through their http://cgi.clamav.net/sendvirus.cgi interface? You can submit them via the web interface. -trog signature.asc Description:

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Trog wrote: Robert Stampfli wrote: My question: Does the ClamAV team want examples of these phishing emails submitted to them through their http://cgi.clamav.net/sendvirus.cgi interface? You can submit them via the web interface. Can I submit my spam, too? It is bad, so it should be

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Trog
On Mon, 2005-03-21 at 16:06 +0100, Julian Mehnle wrote: Trog wrote: Robert Stampfli wrote: My question: Does the ClamAV team want examples of these phishing emails submitted to them through their http://cgi.clamav.net/sendvirus.cgi interface? You can submit them via the web

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Trog wrote: Julian Mehnle wrote: Trog wrote: Robert Stampfli wrote: My question: Does the ClamAV team want examples of these phishing emails submitted to them through their http://cgi.clamav.net/sendvirus.cgi interface? You can submit them via the web interface. Can I

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Sam
On Mon, 21 Mar 2005, McDonald, Dan wrote: They don't think spam, even spam with embedded java script to obscure the nature of the spam, is malware. That was the JS.Scramble pattern that was quite effective at killing off lots of spam, but they chose to remove it, and that's their right.

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread McDonald, Dan
Julian Mehnle wrote: Trog wrote: Julian Mehnle wrote: Trog wrote: Robert Stampfli wrote: My question: Does the ClamAV team want examples of these phishing emails submitted to them through their http://cgi.clamav.net/sendvirus.cgi interface? You can submit them via the web

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Matthew.van.Eerde
Sam wrote: On Mon, 21 Mar 2005, McDonald, Dan wrote: They don't think spam, even spam with embedded java script to obscure the nature of the spam, is malware. That was the JS.Scramble pattern that was quite effective at killing off lots of spam, but they chose to remove it, and that's their

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Trog
On Mon, 2005-03-21 at 08:49 -0800, [EMAIL PROTECTED] wrote: Sam wrote: On Mon, 21 Mar 2005, McDonald, Dan wrote: They don't think spam, even spam with embedded java script to obscure the nature of the spam, is malware. That was the JS.Scramble pattern that was quite effective at killing

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Matthew.van.Eerde
Trog wrote: On Mon, 2005-03-21 at 08:49 -0800, [EMAIL PROTECTED] wrote: Sounds like a feature request to me... can we have a user.cvd file (in addition to main.cvd and daily.cvd) The features been there for a long time already. Read the documentation. Relevant documentation:

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Matthew van Eerde wrote: Sounds like a feature request to me... can we have a user.cvd file (in addition to main.cvd and daily.cvd) Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of 'main.cvd'? ___

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Brian Morrison
On Mon, 21 Mar 2005 18:07:31 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: Matthew van Eerde wrote: Sounds like a feature request to me... can we have a user.cvd file (in addition to main.cvd and daily.cvd) Probably more like: can we have 'technical-threats.cvd' and

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Sam
On Mon, 21 Mar 2005, Trog wrote: On Mon, 2005-03-21 at 08:49 -0800, [EMAIL PROTECTED] wrote: Sam wrote: On Mon, 21 Mar 2005, McDonald, Dan wrote: They don't think spam, even spam with embedded java script to obscure the nature of the spam, is malware. That was the JS.Scramble

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Matt Fretwell
Julian Mehnle wrote: Brian Morrison wrote: Julian Mehnle wrote: Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of 'main.cvd'? You don't give up do you? ;-) Not until someone convincingly explains to me why my request for a

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Matt Fretwell wrote: Julian Mehnle wrote: Brian Morrison wrote: You don't give up do you? ;-) Not until someone convincingly explains to me why my request for a practical option to distinguish between technical and non-technical threats (i.e. exploitation of technical flaws in

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Tomasz Kojm
On Mon, 21 Mar 2005 20:27:46 +0100 Julian Mehnle [EMAIL PROTECTED] wrote: | I absolutely concur. Considering that exactly _no one_ here demanded | that ClamAV abandon its capacity for detecting phishing attacks, little | yellow rubber ducks in PNG images, or whatever else, the uproar is

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Brian Morrison wrote: Julian Mehnle wrote: Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of 'main.cvd'? You don't give up do you? ;-) Not until someone convincingly explains to me why my request for a practical option to distinguish between

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Todd Lyons
Julian Mehnle wanted us to know: | To those of you who argue that ClamAV should detect phishing attacks | even though tools like SpamAssassin are designed and inherently better Perhaps marketing speak would better suit you. McAffee detects phishing emails. What better way to give *ALL* AV

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Matt Fretwell
Julian Mehnle wrote: flames that effectively amount to shut up. Obviously not suggestive enough, though :) Matt ___ http://lurker.clamav.net/list/clamav-users.html

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Tomasz Kojm wrote: Julian Mehnle wrote: | I absolutely concur. Considering that exactly _no one_ here demanded | that ClamAV abandon its capacity for detecting phishing attacks, | little yellow rubber ducks in PNG images, or whatever else, the uproar | is truly ludicrous. What was actually

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Dennis Peterson
Julian Mehnle said: Tomasz Kojm wrote: Julian Mehnle wrote: | I absolutely concur. Considering that exactly _no one_ here demanded | that ClamAV abandon its capacity for detecting phishing attacks, | little yellow rubber ducks in PNG images, or whatever else, the uproar | is truly

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Dennis Peterson wrote: Julian Mehnle said: Well, that is certainly a nice prospect! Thanks a lot for not ignoring my request. That was pretty hard to do. Yeah, people here keep telling me that, though they're not exactly communicative about why that is. All I've read is _I_ don't need

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread clamav
At 12:43 PM 3/21/2005, Julian Mehnle wrote: Dennis Peterson wrote: Julian Mehnle said: Well, that is certainly a nice prospect! Thanks a lot for not ignoring my request. That was pretty hard to do. Yeah, people here keep telling me that, though they're not exactly communicative about why

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Dennis Peterson
Julian Mehnle wrote: Dennis Peterson wrote: Julian Mehnle said: Well, that is certainly a nice prospect! Thanks a lot for not ignoring my request. That was pretty hard to do. Yeah, people here keep telling me that, though they're not exactly communicative about why that is. All I've read is _I_

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Samuel Benzaquen
Yeah, people here keep telling me that, though they're not exactly communicative about why that is. All I've read is _I_ don't need what you are proposing, so shut up or just plain shut up. Little substance, not very helpful, and certainly no reason for me (or anyone!) to stop bringing up

RE: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Julian Mehnle
Samuel Benzaquen wrote: I think the problem is simple math: Finite number of devs with finite time. They have to use it in what they think will be more productive for the majority of us. Hey, I'd accept that for a reason, even though I haven't been the only one who found the feature request

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Matt Fretwell
Julian Mehnle wrote: I think the problem is simple math: Finite number of devs with finite time. They have to use it in what they think will be more productive for the majority of us. Hey, I'd accept that for a reason, even though I haven't been the only one who found the feature

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Brian Morrison
On Mon, 21 Mar 2005 20:06:02 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: Brian Morrison wrote: Julian Mehnle wrote: Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of 'main.cvd'? You don't give up do you? ;-)

Re: [Clamav-users] Report Phishing attacks?

2005-03-21 Thread Steffen Breitbach
Some people wrote some stuff: about SPAM or not. Again. Okay, that's it. I'll unsubscribe. Bye! -- Steffen Breitbach Netzbetrieb Aktuelle Neuigkeiten zur Chamaeleon AG finden Sie unter http://www.chamaeleon.de