<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hugo van der Kooij wrote:
<blockquote
cite="midPine.LNX.4.64.0703072303450.22248@faramir.hugo.vanderkooij.org"
type="cite">Hi,
<br>
<br>
I did manage to get the timestamps sorted out a bit. (If someone has a
log file of last year they could see if the timestamps are ok on
those.) Anything over 11 months old will propably get an inaccurate
timestamp.
<br>
<br>
Download: <a class="moz-txt-link-freetext" href="http://hugo.vanderkooij.org/email/stats/maillog-virus.pl">http://hugo.vanderkooij.org/email/stats/maillog-virus.pl</a>
<br>
<br>
So I now seem to have a way to get the 3 ingredients I want to collect:
<br>
timestamp; AV tool; infection name.
<br>
<br>
The next thing is to write a collector to handle these reports, put
them in a database and show some nice statistics about them.
<br>
<br>
That way there is a way to build a insight into current malware
activity. At least it could tell what is hot today or what was hot
yesterday or last week or ....
<br>
<br>
And finaly it need to be secured so only participating parties can have
their logs analyzed and added to the database so there is at least a
reasonable amount of accuracy.
<br>
<br>
In the end it should resemble the dshield way of doing things by
publishing the interchange format so people can write their own
collectors.
<br>
<br>
So please give this script a spin to see if the collecting is nearing
accuracy for systems running MailScanner and logging silent virusses
including the AV info.
<br>
<br>
The MailScanner config I use contains:
<br>
Virus Scanning = yes
<br>
Virus Scanners = clamav f-prot mcafee
<br>
Silent Viruses = HTML-IFrame All-Viruses
<br>
Log Silent Viruses = yes
<br>
<br>
(I also wrote a bit to parse BitDefender for now.)
<br>
<br>
Hugo.
<br>
<br>
--
<br>
<a class="moz-txt-link-abbreviated" href="mailto:hvdkooij@vanderkooij.org">hvdkooij@vanderkooij.org</a> <a class="moz-txt-link-freetext" href="http://hugo.vanderkooij.org/">http://hugo.vanderkooij.org/</a>
<br>
This message is using 100% recycled electrons.
<br>
<br>
Some men see computers as they are and say "Windows"
<br>
I use computers with Linux and say "Why Windows?"
<br>
(Thanks JFK, for the insight.)
<br>
</blockquote>
<font size="-1"><font face="Verdana">Nice script :^><br>
The filename made me look carefully what it did though :)<br>
</font></font>
</body>
</html>