Hello, Is there a way to configure ClamAV to scan also files with starting GIF87a/GIF89a? We get attacks like this daily.
fgeek@example:~/samples-2012-05-09$ clamdscan x.php* /home/fgeek/samples-2012-05-09/x.php: OK /home/fgeek/samples-2012-05-09/x.php.2: PHP.Bot FOUND ----------- SCAN SUMMARY ----------- Infected files: 1 Time: 0.008 sec (0 m 0 s) fgeek@example:~/samples-2012-05-09$ diff x.php x.php.2 1c1 < GIF89a?????ÿÿÿ!ù????,???????D?;? --- > <?php 514c514 < ?> \ No newline at end of file --- > ?> _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
