> > If netsky is Worm.SomeFool, then why is it not labeled as Worm.SomeFool?
Rhetoric aside, this is obviously an itch that needs scratched. Clam does a wonderful job and (as was the case with SomeFool) does it faster than most. Perhaps we might be able to scratch up support for an alias correlation database, planting the seed with Clam. > No, many people are interested to know more about the viruses which are being > detected. > > If you do a Google search for "NetSky virus" you get 308,000 results. If you > do a Google search for "SomeFool virus" you get 2,080. > > Therefore knowing the more common name for a virus is useful to people who use > ClamAV. I think that, for our purposes, we need only search on the Clam name for a virus. All other names are potentially worthless work--AFAIK, the clam DB contains only (or mostly) viruses in the wild. If we had as part of the submission process an additional field noting what name the detecting AV called it (For example, worm.notagoodguy passes through clam, but is picked up by trend as WORM.BADGUY). Any aliases that we come up with could get submitted right alongside such a sample. Our search really only needs to be one-way, to keep it in scope. There's no need to support searching everyone else's names, only Clam's. Everyone's talking about NetSky? If you're not receiving SomeFool, then why do you care? If you are, look up SomeFool. If you're getting files and Clam doesn't detect them, then submit them. They'll be named, and you'll be able to search. --Seth ------------------------------------------------------- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
