You missed my point. It was it was a shame that safe browsing sigs only for of files that look like email.
> On Nov 11, 2016, at 12:43 AM, Gene Heskett <ghesk...@shentel.net> wrote: > > On Thursday 10 November 2016 17:45:24 TR Shaw wrote: > >> Thanks, all. >> >> However its a real shame that it will not scan generic files looking >> for bad urls rather than only scanning email files. >> >> I was going to to use clamav to scan disk drives for scripts that used >> uris in safe browsing So much of that :-( >> >> Tom > > It scans disks just fine, has caught one real, and 2 fp's in the 3 years > or so I've been using it. I also have clamscand scanning all incoming > emails, and it has quaranteened, in the past year, > -rw-r--r-- 1 gene mail 113710 Jun 6 08:13 virii > So there is probably 3, maybe more, attacks in there. I usually zero > that file out on new years day. The clamav tools can do a lot, if used > for the jobs they were designed to do. Read the docs, then read them > again. > >>> On Nov 10, 2016, at 3:46 PM, Steve basford >>> <steveb_cla...@sanesecurity.com> wrote: >>> >>> Hi Tom, >>> >>> Create a standard header body formatted email and then insert the >>> address at the end. >>> >>> It will be detected. Just placing on a line.. it won't be detected, >>> >>> Cheers, >>> >>> Steve >>> Twitter: @sanesecurity >>> >>> On 10 November 2016 19:53:05 TR Shaw <ts...@oitc.com> wrote: >>>> I have freshclam set to load safe browsing: >>>> >>>> -rw-r--r-- 1 _clamav admin 57874944 Nov 10 11:51 daily.cld >>>> -rw-r--r-- 1 _clamav admin 103419904 Nov 10 13:51 >>>> safebrowsing.cld >>>> >>>> I placed http://ianfette[.]org/ in a file safebrowsingtest.txt >>>> >>>> Then I run clam and expect to hit safe browsing but I instead I get >>>> OK. >>>> >>>> $ clamscan -v safebrowsingtest.txt >>>> Scanning safebrowsingtest.txt >>>> safebrowsingtest.txt: OK >>>> >>>> ----------- SCAN SUMMARY ----------- >>>> Known viruses: 8073056 >>>> Engine version: 0.99.2 >>>> Scanned directories: 0 >>>> Scanned files: 1 >>>> Infected files: 0 >>>> Data scanned: 0.00 MB >>>> Data read: 0.00 MB (ratio 0.00:1) >>>> Time: 12.567 sec (0 m 12 s) >>>> >>>> When I place http://ianfette[.]org/ in a browser I get the safe >>>> browsing alert. Any ideas what I am doing wrong? >>>> >>>> Tom >>>> >>>> >>>> _______________________________________________ >>>> clamav-users mailing list >>>> clamav-users@lists.clamav.net >>>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>>> >>>> >>>> Help us build a comprehensive ClamAV guide: >>>> https://github.com/vrtadmin/clamav-faq >>>> >>>> http://www.clamav.net/contact.html#ml >>> >>> _______________________________________________ >>> clamav-users mailing list >>> clamav-users@lists.clamav.net >>> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >>> >>> >>> Help us build a comprehensive ClamAV guide: >>> https://github.com/vrtadmin/clamav-faq >>> >>> http://www.clamav.net/contact.html#ml >> >> _______________________________________________ >> clamav-users mailing list >> clamav-users@lists.clamav.net <mailto:clamav-users@lists.clamav.net> >> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users >> <http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users> >> >> >> Help us build a comprehensive ClamAV guide: >> https://github.com/vrtadmin/clamav-faq >> <https://github.com/vrtadmin/clamav-faq> >> >> http://www.clamav.net/contact.html#ml <http://www.clamav.net/contact.html#ml> > > > Cheers, Gene Heskett > -- > "There are four boxes to be used in defense of liberty: > soap, ballot, jury, and ammo. Please use in that order." > -Ed Howdershelt (Author) > Genes Web page <http://geneslinuxbox.net:6309/gene > <http://geneslinuxbox.net:6309/gene>> > _______________________________________________ > clamav-users mailing list > clamav-users@lists.clamav.net <mailto:clamav-users@lists.clamav.net> > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users > <http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users> > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > <https://github.com/vrtadmin/clamav-faq> > > http://www.clamav.net/contact.html#ml <http://www.clamav.net/contact.html#ml> _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
