----- Original Message ----- From: "Steve Basford" <[EMAIL PROTECTED]> To: "ClamAV users ML" <clamav-users@lists.clamav.net> Sent: Tuesday, February 28, 2006 1:07 PM Subject: Re: [Fwd: Re: [Clamav-users] custom signatures not working]
> Some example sigs... Note the case of the text > > Sig eg 1: > > Html.Phishing.Pay.Gen017.Sanesecurity.06022800:3:*:646561722070617970616c206 d656d626572 > > > Note: type 3 is used (HTML) which means the file is normalised > > so : 646561722070617970616c206d656d626572 is (dear paypal member) > > will match: Dear PayPal Member > and : Dear Paypal member > and : dear paypal member > and : Dear PayPal Members > > Sig eg 2: > > Html.Phishing.Pay.Gen017.Sanesecurity.06022800:0:*:446561722050617950616c204 d656d626572 > Thanks for the help Steve. Well, I've noticed something that doesn't quite make sense Sending a message containing only "Dear PayPal Member" does not get flagged However, a message containing only "Dear PayPal Member" and a attachment (a simple blank txt file works) and message gets flagged as intended. In other words, the only time "Dear PayPal Member" gets detected is if there's an attachment, empty or otherwise _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
