There has been some discussion on the Sanesecurity users list about ClamAV signatures matching unintended words. For example, a signature that is written to match "acebook . com" (remove the spaces) would also match "facebook . com".
Is there a way to delimit what can precede a signature? For example, allow preceding character matching if the preceding character is NOT an alpha/numeric character? This would allow all of the following to match: http://acebook . com http://your.acebook . com http://your.acebook . com/some/path.htm But not match: http://facebook . com http://www.facebook . com http://www.facebook . com/some/path.htm Thoughts or suggestions would be greatly appreciated. Bill _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
