Quick dump of found signature results: ClamAV vs Basford et al

Unofficial sigs, total:
grep UNOFFICIAL clam* |wc -l
174

Unofficial Sane Security sigs found
grep Sanesecur.*FOUND clam* |wc -l
141

Official ClamAV sigs found:
grep FOUND clam* |grep -c -v UNOFFICIAL
10

Non-Sanesecurity unofficial sigs found:
grep UNOFFICIAL clam* |grep -v Sanesecurity |awk '{print $8}' |sort |uniq -c |sort -rn
      7 winnow.spam.ts.stock.4.UNOFFICIAL
      7 ScamNailer.Phish.info_AT_un.org.UNOFFICIAL
      3 winnow.spam.ts.miscspam.843424.UNOFFICIAL
      3 winnow.malware.m0.malware.863749.UNOFFICIAL
      2 winnow.spam.ts.yahoo.1.UNOFFICIAL
      2 winnow.spam.ts.miscspam.848859.UNOFFICIAL
      2 ScamNailer.Phish.info_AT_uk-lotto.co.uk.UNOFFICIAL
      1 winnow.spam.ts.photoeditting.12.UNOFFICIAL
      1 winnow.spam.ts.miscspam.842244.UNOFFICIAL
      1 ScamNailer.Phish.test_AT_test.com.UNOFFICIAL
      1 ScamNailer.Phish.neyland_AT_gonzaga.edu.UNOFFICIAL
      1 ScamNailer.Phish.info_AT_loan.com.UNOFFICIAL
      1 ScamNailer.Phish.info_AT_it.org.UNOFFICIAL
      1 ScamNailer.Phish.fedmail_AT_fedmail.prime-vendor.com.UNOFFICIAL
33

Good job, Steve.

On 6/23/14, 10:36 AM, Steve Basford wrote:
On Mon, June 23, 2014 4:47 pm, Walter Bürger wrote:
This morning I submitted the file
Rechnung_23_14_06_198630274520031_telekom_deutschland_GmbH.exe
(MD5 ad690be247dda635781e20887fcac0e7)
on virustotal.com.

4 out of 54 scanners detected a virus
(NOD32 named it Win32/Kryptik.CFAE)
but ClamAV did not detect it.
Hi Walter,

This was added to phish.ndb:

Sanesecurity.Malware.23787.ZipHeur

Added: 23 Jun 2014 09:32:40 UT

Cheers,

Steve
Sanesecurity.com

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/support/ml

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/support/ml

Reply via email to