Bill Thank you for the heads up. In the process of reviewing this, I discovered I'd not updated my download scripts to reflect the .gz extension and my last update had occurred last month. I vaguely recall someone pointing this out some time ago. I rewrote my script to download asnd unzip the phish.ndb.gz and all is once again well.
I've had no problems with the phishing db and have come to rely on it. I look forward to the scam results. I'm pretty happy with my setup now. Declude (latest build) Sniffer AGV, f-prot (soon to be gone) and clamAV invURIBL John -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Monday, August 07, 2006 1:40 PM To: declude.junkmail@declude.com; declude.virus@declude.com Subject: [Declude.JunkMail] Fw: New ClamAV "scam" database For anyone that is possibly running ClamAV for virus scanning, and is already taking advantage of the added "phish" detection provided by Steve Basford's phish.ndb, he has put together another database geared to tagging "scam" e-mails, including those pesky image spams. The new scam database is working great here, lots of catches so far and no FPs yet. If you want to give it a run, please do heed Steve's request at the end of this message about scripting the downloads for the new scam.ndb, at least for now... Thanks, Bill ----- Original Message ----- From: "Steve Basford" <[EMAIL PROTECTED]> To: "Bill Landry" <[EMAIL PROTECTED]> Sent: Monday, August 07, 2006 12:51 PM Subject: Re: scam database >>> Hi Bill, >>> >>> Just to let you know I've done a big update to the scam database, >>> which isn't publicily known about yet but >>> it's working a treat this end, with a lot of those image spams :) >>> >>> If you want to give a manual trial run: >>> http://www.sanesecurity.com/clamav/scam.ndb.gz >>> >>> Cheers, >>> >>> Steve >> >> Bill Landry wrote: >> >> Wow, Steve, this is working very well! Nice work. Do you mind if I >> let others know about the availability of this new scam database? > > That's great! It's working too, for me at work... and two other brave > "test" sites :) > > Yep, you can let people know but... > > Please could you ask people to only *manually* download the file for the > time being, no scripts, it'll only > get updated once a day at the moment, when I see a big new image spam > run: > > Main Site: http://www.sanesecurity.com/clamav/ > Scam Database: http://www.sanesecurity.com/clamav/scam.ndb.gz > Phishing Database: http://www.sanesecurity.com/clamav/phish.ndb.gz > > Glad it's helping :) > > Cheers, > > Steve --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
