[clamav-users] Clamav cannot detect a malware using a signature based on html comment

Hello Clamav Team, To detect some JS includers, I need to create a signature based on HTML comment. Here is an example # cat test.html I *need* to include the comment tags to avoid false positives. I tried several signatures : # cat test.ndb test:7:*:3c212d2d20546869732069732061206d616c77

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

On Tue, January 26, 2016 10:49 am, Arnaud Jacques / SecuriteInfo.com wrote: > Hello Clamav Team, > > I *need* to include the comment tags to avoid false positives. I tried > several signatures : # cat test.ndb I've seen the same sometimes I've had to end up using type 0, instead of 3/4/7 whic

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

Hello Steve, > I've seen the same sometimes I've had to end up using type 0, instead > of 3/4/7 which isn't ideal. Even with filetype 0 this doesn't match : # cat test.ndb test:7:*:3c212d2d20546869732069732061206d616c77617265202d2d3e test:7:*:3c212d2d20746869732069732061206d616c77617265202d2

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

On Tue, January 26, 2016 11:54 am, Arnaud Jacques / SecuriteInfo.com wrote: > Hello Steve, > > >> I've seen the same sometimes I've had to end up using type 0, >> instead of 3/4/7 which isn't ideal. > > Even with filetype 0 this doesn't match : Hi Arnaud, Can you attach a sample... see if I c

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

Arnaud: Did you normalize your file? I.e. Clamscan--leave-temps? - Alain -Alain > On Jan 26, 2016, at 6:55 AM, Arnaud Jacques / SecuriteInfo.com > wrote: > > Hello Steve, > >> I've seen the same sometimes I've had to end up using type 0, instead >> of 3/4/7 which isn't ideal. > > Even wit

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

Hello Alain, > Did you normalize your file? I.e. Clamscan--leave-temps? You didn't understand :) If I normalize the file, the HTML comments are deleted. I need them to create a signature. -- Best regards, Arnaud Jacques SecuriteInfo.com Facebook : https://www.facebook.com/pages/SecuriteInfoc

[clamav-users] clamav-milter crash

i have seen it do this so many times now that i like to know if its just me that use it or its known problem upgrade to 0.99 does not help, currently on the stable gentoo 0.98.7 is there a github version of clamav ? ___ Help us build a comprehensive C

Re: [clamav-users] clamav-milter crash

On Tue, January 26, 2016 2:26 pm, Benny Pedersen wrote: > is there a github version of clamav ? > ___ https://github.com/vrtadmin/clamav-devel Cheers, Steve Web : sanesecurity.com Blog: sanesecurity.blogspot.com Twitter: @sanesecurity __

Re: [clamav-users] clamav-milter crash

If this is still a problem with the most current software on github, please create a bug report at http://bugzilla.clamav.net. Please attach samples that result in the crash. Steve On Tue, Jan 26, 2016 at 9:26 AM, Benny Pedersen wrote: > i have seen it do this so many times now that i like to

[clamav-users] SaneSecurity SpearL signatures

Hi, I had a spate of reports about an FP in the SaneSecurity SpearL list. It included a URL that’s attached by MessaageLabs when it scans outbound mail from the University of Brighton (which is just over the road from us). However, the reports that came in referred variously to Sanesecurity.Sp

Re: [clamav-users] SaneSecurity SpearL signatures

On Tue, January 26, 2016 4:21 pm, Ian Eiloart wrote: > Hi, > > > I had a spate of reports about an FP in the SaneSecurity SpearL list. It > included a URL that’s attached by MessaageLabs when it scans outbound > mail from the University of Brighton (which is just over the road from > us). Hi Ian

[clamav-users] Clamd high CPU during clamdscan

I have rolled out clamd to a handful of Red Hat systems and they all seem to have high CPU usage when clamdscan runs at 2am. The rest of the day, clamd drops down to minimal usage. There isn't a lot of change on these systems so I can't imagine it's finding much, but it really pegs the CPU's. What

Re: [clamav-users] clamav-milter crash

On 2016-01-26 16:46, Steven Morgan wrote: If this is still a problem with the most current software on github, please create a bug report at http://bugzilla.clamav.net. Please attach samples that result in the crash. this is the hard part if not recieved i have added clamav- now to fidon

Re: [clamav-users] clamav-milter crash

Hi there, On Tue, 26 Jan 2016, Benny Pedersen wrote: i have seen it [crash] so many times now that i like to know if its just me that use it or its known problem It might just be you. I've been using clamav-milter on various mail servers for more than a decade and I can't remember ever seein

Re: [clamav-users] Clamav cannot detect a malware using a signature based on html comment

test.html THIS IS A MALWARE Test signatures: this is a malware This is a malware test.ndb test1:3:*:3c212d2d20546869732069732061206d616c77617265202d2d3e test2:3:*:3c212d2d20746869732069732061206d616c77617265202d2d3e test3:3:*:20746869732069732061206d616c7761726520 test4:3:*:205468697

Re: [clamav-users] Clamd high CPU during clamdscan

What's "high cpu" in this instance ... you should expect system resources to be consumed when the on-demand scans run, are you seeing high load averages, what are you using to diagnose high cpu, is it simply a per core spike? On Jan 26, 2016 13:27, "Jeff Johnson" wrote: > I have rolled out clamd

Re: [clamav-users] Clamd high CPU during clamdscan

The "nice" utility is your very best friend. It yields CPU time to other operations but will run like crazy of nothing else is a higher priority. Clam is a disk IO heavy process for obvious reasons, and can drive disk waits up quite high. It is also CPU intensive but should occupy a single core.