Kevin Spicer wrote: > On Mon, 2004-05-10 at 18:24, jef moskot wrote: >> So, if I type in "Netsky", I don't see any ties to SomeFool. If I put in >> "SomeFool", I don't see any immediate reference to Netsky, but if I poke >> around a little, it becomes apparent that we're talking about the same >> thing. > But if you put in Worm.somefool (which is what clam actually calls it), > or click on worm.somefool vendor clamav when you search on 'contains > somefool' You can see it is Netsky as reported by some other vendors > >> Not sure how it should be implemented, > > Me either! My current thinking is to do it as automatically as > possible, otherwise I'll just get bored / occupied doing something else > and not keep the alias mapping up to date > > I did think about doing some kind of 'smart-search' but thats going to > need some thinking about. Maybe...
Do you actually run multiple AV vendor products on your machine? My idea (which I clearly don't have the monetary backing to implement) was to run as many AV products as possible on every email coming through my system. Not only would this virtually insure that your mail server's mail is virus free (albeit at great system CPU and monetary expense), but you'd also be able to automate the aliasing process with great ease for new viruses, as well as flag and auto-submit viruses that ClamAV doesn't detect yet. I think you might even be able to sell that sort of service to ISPs, as long as you make the monthly or yearly membership price low enough. Your current setup looks like a great effort, but it doesn't seem to work very well. I type in 'netsky' with "Virus name contains above" selected, then click on "Netsky.AB Vendor: Fsecure" and the resulting page doesn't even mention Worm.Somefool.AB. I'm impressed by the information that *is* there though. If you can tweak it until it spits out more relevant information then it looks like you'll have a winning service. -- Jesse Guardiani, Systems Administrator WingNET Internet Services, P.O. Box 2605 // Cleveland, TN 37320-2605 423-559-LINK (v) 423-559-5145 (f) http://www.wingnet.net ------------------------------------------------------- This SF.Net email is sponsored by Sleepycat Software Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to deliver higher performing products faster, at low TCO. http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3 _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
