Silent Viruses and Mydoom

[Sebastian Wiesinger]

* Matthew K Bowman <mkbowman at neo.rr.com> [2004-01-28 17:52]:
> Hi,
>
> I setup a Ruleset for MyDoom but users are still be notified:
>
> Ruleset below:
>
> Virus: default yes
> Virus: Bagle    no
> Virus: MyDoom   no
> Virus: NoVarg   no
> FromOrTo: default yes
>
> Is my syntax and wording ok?

First, the ruleset uses the first line matching, so put your first
line from top to the bottom.

If you're using ClamAV you should add:

Virus: SCO      no

before your default line.

Like this:

Virus: Bagle    no
Virus: MyDoom   no
Virus: NoVarg   no
Virus: SCO      no
Virus: default yes

Sebastian