On Thu, Mar 17, 2005 at 07:24:15PM +0100, Tomasz Kojm wrote: > > > Your clamd doesn't support meta-data signatures. > > So that will be a feature of 0.84 then? > Yes, it will (already supported in CVS).
Great! I've been "using" meta-data signatures, via procmail, probably since "sircam" came out in 2001, and it works very good. I'm still catching mydoom variants using a procmail recipe I wrote in 2003 (much to my surprise, I might add). (See http://www.xs4all.nl/~johnpc/procmailrc.txt if you're interested). But it's also bad, since if a high-profile virus scanner like ClamAV is going to start matching meta-data, then virus writers are more likely to notice and start changing it with each virus release, making my procmail hackery less effective ;) -- #!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig; # Jan-Pieter Cornet _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
