<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Please ignore my questions about clamd, i have it running in
MailScanner. But further advice on sigtool and sane would be great ! :)<br>
Pete<br>
<br>
<br>
Pete Russell wrote:
<blockquote cite="mid:4AFBE329.30503@iinet.net.au" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
Thanks for the advice. These emails ahve no attachments, see linked
example to a whole file. <a moz-do-not-send="true"
class="moz-txt-link-freetext" href="http://sharesend.com/avty7">http://sharesend.com/avty7</a>
Its txt/html only
an this seems to be the norm for these malware emails.<br>
<br>
I have started reading about clamazsmtp - thanks for the tip. I have
started using Sane Clamav extra sigs, but not sure how to add the extra
ones you mentioned - more reading for me :) Not sure if this will help
with txt/html emails? <br>
<br>
I tried using the sigtool - i created the hdb and added to
/usr/local/share/clamav (where the cvd files are?) but forwarding the
email didnt trigger clamav?<br>
<br>
Question about mailscanner.conf - i ahd to change he Virus Scanners =
line so MailWatch would behave - i added clamav, but i am using Julians
Clam/SA package should this entry be clamavmodule or clamd ?<br>
<br>
Appreciate the help.<br>
Pete<br>
<br>
<br>
<br>
Steve Basford wrote:
<blockquote
cite="mid:51219.93.97.28.110.1258016399.squirrel@saturn.dataflame.net"
type="cite">
<blockquote type="cite">
<pre wrap="">So far i have razor, latest mailscanner, SA, bayes, malwarepatrol rules.
Should i go with DCC or pyzor to target these emails, any other
suggestions?
</pre>
</blockquote>
<pre wrap=""><!---->
Hi Pete,
Add on ClamAV... at smtp:
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://memberwebs.com/stef/software/clamsmtp/">http://memberwebs.com/stef/software/clamsmtp/</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.clamav.net/download/third-party-tools/3rdparty-mta/">http://www.clamav.net/download/third-party-tools/3rdparty-mta/</a>
etc.
Add on: Sanesecurity signatures:
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://sanesecurity.co.uk/download_scripts_linux.htm">http://sanesecurity.co.uk/download_scripts_linux.htm</a>
(include phish.ndb/scam.ndb/rouge.hdb, scamnailer, winnow* and inetmsg*)
*or* all of them if you have the horsepower
If you are running ClamAV you can then create your own hash sigs for the
attachments being sent out:
sigtool --md5 maware.zip > mymalware.hdb
Copy mymalware.hdb into the ClamAV data directory and away you go...
Cheers,
Steve
Sanesecurity
</pre>
</blockquote>
<br>
</blockquote>
<br>
</body>
</html>