On Wednesday 19 May 2004 12:54 pm, Betsy Schwartz wrote:
> Some PC's on our network have been flagged as having
> "agobot,gaobot,polybot" (or a sasser variant), by the perimiter security
> system. I have looked at Kevin's excellent database at
> http://www.rainingfrogs.co.uk and don't see any matches made between these
> names and clamav.
> Reading the vendor descriptions, some but not all of these *bot worms
> propagate via SMTP.
>
> Are these in ClamAv under another name, or are the vendors wrong about the
> SMTP part, or is ClamAv behind? I will try to get a sample from the PC
> folks. It's quite possible that we have one of the non-SMTP varieties.
ClamAV knows about several gaobot varieties.
Try a "sigtool -l | grep -i gaobot" on your system.
Regards,
Antony.
--
Perfection in design is achieved not when there is nothing left to add, but
rather when there is nothing left to take away.
- Antoine de Saint-Exupery
Please reply to the list;
please don't CC me.
-------------------------------------------------------
This SF.Net email is sponsored by: SourceForge.net Broadband
Sign-up now for SourceForge Broadband and get the fastest
6.0/768 connection for only $19.95/mo for the first 3 months!
http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
