Re: [Declude.JunkMail] Fw: New ClamAV scam database
Thanks much Bill, -Nick Bill Landry wrote: For anyone that is possibly running ClamAV for virus scanning, and is already taking advantage of the added phish detection provided by Steve Basford's phish.ndb, he has put together another database geared to tagging scam e-mails, including those pesky image spams. The new scam database is working great here, lots of catches so far and no FPs yet. If you want to give it a run, please do heed Steve's request at the end of this message about scripting the downloads for the new scam.ndb, at least for now... Thanks, Bill - Original Message - From: Steve Basford [EMAIL PROTECTED] To: Bill Landry [EMAIL PROTECTED] Sent: Monday, August 07, 2006 12:51 PM Subject: Re: scam database Hi Bill, Just to let you know I've done a big update to the scam database, which isn't publicily known about yet but it's working a treat this end, with a lot of those image spams :) If you want to give a manual trial run: http://www.sanesecurity.com/clamav/scam.ndb.gz Cheers, Steve Bill Landry wrote: Wow, Steve, this is working very well! Nice work. Do you mind if I let others know about the availability of this new scam database? That's great! It's working too, for me at work... and two other brave test sites :) Yep, you can let people know but... Please could you ask people to only *manually* download the file for the time being, no scripts, it'll only get updated once a day at the moment, when I see a big new image spam run: Main Site: http://www.sanesecurity.com/clamav/ Scam Database: http://www.sanesecurity.com/clamav/scam.ndb.gz Phishing Database: http://www.sanesecurity.com/clamav/phish.ndb.gz Glad it's helping :) Cheers, Steve --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fw: New ClamAV scam database
Bill Thank you for the heads up. In the process of reviewing this, I discovered I'd not updated my download scripts to reflect the .gz extension and my last update had occurred last month. I vaguely recall someone pointing this out some time ago. I rewrote my script to download asnd unzip the phish.ndb.gz and all is once again well. I've had no problems with the phishing db and have come to rely on it. I look forward to the scam results. I'm pretty happy with my setup now. Declude (latest build) Sniffer AGV, f-prot (soon to be gone) and clamAV invURIBL John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry Sent: Monday, August 07, 2006 1:40 PM To: declude.junkmail@declude.com; declude.virus@declude.com Subject: [Declude.JunkMail] Fw: New ClamAV scam database For anyone that is possibly running ClamAV for virus scanning, and is already taking advantage of the added phish detection provided by Steve Basford's phish.ndb, he has put together another database geared to tagging scam e-mails, including those pesky image spams. The new scam database is working great here, lots of catches so far and no FPs yet. If you want to give it a run, please do heed Steve's request at the end of this message about scripting the downloads for the new scam.ndb, at least for now... Thanks, Bill - Original Message - From: Steve Basford [EMAIL PROTECTED] To: Bill Landry [EMAIL PROTECTED] Sent: Monday, August 07, 2006 12:51 PM Subject: Re: scam database Hi Bill, Just to let you know I've done a big update to the scam database, which isn't publicily known about yet but it's working a treat this end, with a lot of those image spams :) If you want to give a manual trial run: http://www.sanesecurity.com/clamav/scam.ndb.gz Cheers, Steve Bill Landry wrote: Wow, Steve, this is working very well! Nice work. Do you mind if I let others know about the availability of this new scam database? That's great! It's working too, for me at work... and two other brave test sites :) Yep, you can let people know but... Please could you ask people to only *manually* download the file for the time being, no scripts, it'll only get updated once a day at the moment, when I see a big new image spam run: Main Site: http://www.sanesecurity.com/clamav/ Scam Database: http://www.sanesecurity.com/clamav/scam.ndb.gz Phishing Database: http://www.sanesecurity.com/clamav/phish.ndb.gz Glad it's helping :) Cheers, Steve --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Fw: New ClamAV scam database
I am using clamav on windows. Can I do this? Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com E : [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Doyle Sent: Tuesday, August 08, 2006 12:59 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Fw: New ClamAV scam database Bill Thank you for the heads up. In the process of reviewing this, I discovered I'd not updated my download scripts to reflect the .gz extension and my last update had occurred last month. I vaguely recall someone pointing this out some time ago. I rewrote my script to download asnd unzip the phish.ndb.gz and all is once again well. I've had no problems with the phishing db and have come to rely on it. I look forward to the scam results. I'm pretty happy with my setup now. Declude (latest build) Sniffer AGV, f-prot (soon to be gone) and clamAV invURIBL John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Bill Landry Sent: Monday, August 07, 2006 1:40 PM To: declude.junkmail@declude.com; declude.virus@declude.com Subject: [Declude.JunkMail] Fw: New ClamAV scam database For anyone that is possibly running ClamAV for virus scanning, and is already taking advantage of the added phish detection provided by Steve Basford's phish.ndb, he has put together another database geared to tagging scam e-mails, including those pesky image spams. The new scam database is working great here, lots of catches so far and no FPs yet.If you want to give it a run, please do heed Steve's request at the end of this message about scripting the downloads for the new scam.ndb, at least for now... Thanks, Bill - Original Message - From: Steve Basford [EMAIL PROTECTED] To: Bill Landry [EMAIL PROTECTED] Sent: Monday, August 07, 2006 12:51 PM Subject: Re: scam database Hi Bill, Just to let you know I've done a big update to the scam database, which isn't publicily known about yet but it's working a treat this end, with a lot of those image spams :) If you want to give a manual trial run: http://www.sanesecurity.com/clamav/scam.ndb.gz Cheers, Steve Bill Landry wrote: Wow, Steve, this is working very well!Nice work.Do you mind if I let others know about the availability of this new scam database? That's great!It's working too, for me at work... and two other brave test sites :) Yep, you can let people know but... Please could you ask people to only *manually* download the file for the time being, no scripts, it'll only get updated once a day at the moment, when Isee a big new image spam run: Main Site: http://www.sanesecurity.com/clamav/ Scam Database: http://www.sanesecurity.com/clamav/scam.ndb.gz Phishing Database: http://www.sanesecurity.com/clamav/phish.ndb.gz Glad it's helping :) Cheers, Steve --- This E-mail came from the Declude.JunkMail mailing list.To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail.The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list.To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail.The archives can be found at http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
Re: [Declude.JunkMail] Fw: New ClamAV scam database
Sure, just drop the ndb files into the same directory where your daily.cvd and main.cvd files are located and then restart your clamd service (if you have it running as a service). Bill - Original Message - From: Craig Edmonds To: declude.junkmail@declude.com Sent: Monday, August 07, 2006 4:22 PM Subject: RE: [Declude.JunkMail] Fw: New ClamAV "scam" database I am using clamav on windows.Can I do this?Kindest RegardsCraig Edmonds123 Marbella InternetW: www.123marbella.comE : [EMAIL PROTECTED]-Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of JohnDoyleSent: Tuesday, August 08, 2006 12:59 AMTo: declude.junkmail@declude.comSubject: RE: [Declude.JunkMail] Fw: New ClamAV "scam" databaseBillThank you for the heads up.In the process of reviewing this, I discovered I'd not updated my downloadscripts to reflect the .gz extension and my last update had occurred lastmonth. I vaguely recall someone pointing this out some time ago. I rewrotemy script to download asnd unzip the phish.ndb.gz and all is once againwell.I've had no problems with the phishing db and have come to rely on it.I look forward to the scam results.I'm pretty happy with my setup now.Declude (latest build)SnifferAGV, f-prot (soon to be gone) and clamAV invURIBLJohn-Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of BillLandrySent: Monday, August 07, 2006 1:40 PMTo: declude.junkmail@declude.com; declude.virus@declude.comSubject: [Declude.JunkMail] Fw: New ClamAV "scam" databaseFor anyone that is possibly running ClamAV for virus scanning, and isalready taking advantage of the added "phish" detection provided by SteveBasford's phish.ndb, he has put together another database geared to tagging"scam" e-mails, including those pesky image spams.The new scam database is working great here, lots of catches so far and noFPs yet.If you want to give it a run, please do heed Steve's request atthe end of this message about scripting the downloads for the new scam.ndb,at least for now...Thanks,Bill- Original Message -From: "Steve Basford" [EMAIL PROTECTED]To: "Bill Landry" [EMAIL PROTECTED]Sent: Monday, August 07, 2006 12:51 PMSubject: Re: scam database Hi Bill, Just to let you know I've done a big update to the scam database, which isn't publicily known about yet but it's working a treat this end, with a lot of those image spams :) If you want to give a manual trial run: http://www.sanesecurity.com/clamav/scam.ndb.gz Cheers, Steve Bill Landry wrote: Wow, Steve, this is working very well!Nice work.Do you mind if I let others know about the availability of this new scam database? That's great!It's working too, for me at work... and two other brave "test" sites :) Yep, you can let people know but... Please could you ask people to only *manually* download the file for the time being, no scripts, it'll only get updated once a day at the moment, when Isee a big new image spam run: Main Site: http://www.sanesecurity.com/clamav/ Scam Database: http://www.sanesecurity.com/clamav/scam.ndb.gz Phishing Database: http://www.sanesecurity.com/clamav/phish.ndb.gz Glad it's helping :) Cheers, Steve---This E-mail came from the Declude.JunkMail mailing list.To unsubscribe,just send an E-mail to [EMAIL PROTECTED], and type "unsubscribeDeclude.JunkMail".The archives can be found athttp://www.mail-archive.com.---This E-mail came from the Declude.JunkMail mailing list.To unsubscribe,just send an E-mail to [EMAIL PROTECTED], and type "unsubscribeDeclude.JunkMail".The archives can be found athttp://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com. ---This E-mail came from the Declude.JunkMail mailing list. Tounsubscribe, just send an E-mail to [EMAIL PROTECTED], andtype "unsubscribe Declude.JunkMail". The archives can be foundat http://www.mail-archive.com.
