On Saturday 10 January 2004 8:48 pm, Philipp Grosswiler wrote:
> > That depends on how broken it is.
>
> I guess that's the problem with this virus. It is so badly written.
>
> > If what you have is a damaged piece of viral code, does it really
> > matter which virus it was before it got damaged?
>
> In some cases, yes. I am having a statistics where I would like to know
> which virus it was instead of "Seriously Broken Zip". I don't think
> that's a bad thing, but why shouldn't it possible to have a signature of
> this damaged virus?
If you want a signature which will match something specific, you can always
create your own - check the clamav sigtool, and remember that clamscan will
use any/all the .db and .db? files it finds in /usr/local/share/clamav, so
just put your own signature/s into a special file in this directory (I think
it uses them in alphabetic order, so name yours to come before "viruses" to
make sure your signature gets checked before the generic one).
Antony.
--
The words "e pluribus unum" on the Great Seal of the United States are from a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the list;
please don't CC me.
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
