On 12/18/14 6:29 AM, polloxx wrote:
Since more and more malware is not attached to a mail but only an url to
it, detecting it is challenge. Is there any good url scanner avalable for
Clamav?
Thx,
P.
The Sendmail/Postfix milter J-Chkmail (and front end for ClamAV) can use DNS or
regular expressions to detect URLs. I keep a local DNS table of bogus uri's
built from spam traps and uncaught spam, and also use multi.uribl.com (see
http://uribl.com/) which has a comprehensive DNS-based URL list. The regex
aspect of it can filter on complete URI content rather just on host names. It is
incredibly effective and inexpensive in terms of CPU and time.
Learn more at http://www.j-chkmail.org/
dp
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
