Exim, ClamAV, Bagle.[QRST]

[Tony Finch]

Tony Finch <dot at DOTAT.AT> wrote:
>Note that Clam's current signature for the latest Bagle worms doesn't
>work because it assumes that newlines are in SMTP CRLF form, whereas
>Exim converts them to Unix LF form before Clam gets to see the message.
>You can create a local.db file in your clamav database directory containing
>the following signatures:

Actually there are more variants than that. I have seen all of the following:

Exploit.HTML.Bagle.Q-camA-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e7420666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e652220444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camB-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e742020666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e652220444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camC-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e7420666163653d2253797374656d223e0a3c4f424a45435420205354594c453d22646973706c61793a6e6f6e652220444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camD-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e742020666163653d2253797374656d223e0a3c4f424a45435420205354594c453d22646973706c61793a6e6f6e652220444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camE-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e7420666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camF-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e742020666163653d2253797374656d223e0a3c4f424a454354205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camG-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e7420666163653d2253797374656d223e0a3c4f424a45435420205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e
Exploit.HTML.Bagle.Q-camH-eml (Clam)=3c68746d6c3e3c626f64793e0a3c666f6e742020666163653d2253797374656d223e0a3c4f424a45435420205354594c453d22646973706c61793a6e6f6e65222020444154413d22687474703a2f2f*2e706870223e0a3c2f4f424a4543543e

Tony.
--
f.a.n.finch  <dot at dotat.at>  http://dotat.at/
SOUTHEAST ICELAND: CYCLONIC OR SOUTHWESTERLY, 4 OR 5, OCCASIONALLY 6. RAIN OR
SQUALLY WINTRY SHOWERS. MODERATE OR GOOD.