Unofficial clamav phishing sigs

[Richard Siddall]

Ugo Bellavance wrote:
> 	Anyone tried these ones?
> http://www.sanesecurity.com/clamav/
> 
> Any false positives?
> 
> I asked the clamav staff about their opinion and they said that they
> cannot give an opinion since they don't use it.
> 

Yes.  Been using them for a couple of months.  We're using download
scripts based on the ones Phil Randal posted to this list (most recently
on 5/31).

We've had one known false positive.  I mailed the sendmail queue files
to Steve Basford and he fixed it within 24 hours.

I have noticed recently that some, or all, of the e-mails flagged by the
Sane Security signatures are disinfected.  Since MS quarantines them,
I'd much rather have them deleted and recovered from the quarantine if
necessary.

Regards,

	Richard Siddall