Re: [clamav-users] Generating signatures for malware

2012-08-29 Thread Maarten Broekman
> -Original Message- > > > The rate of false positives is wholly dependent on the strings that > > > you are replacing with wildcards. > > > > > > As an example, when generating signatures to identify phishing > > > content (say, content targeting bank customers), I wanted to be > able > >

Re: [clamav-users] Generating signatures for malware

2012-08-29 Thread David Raynor
On Wed, Aug 29, 2012 at 10:29 AM, Michael Orlitzky wrote: > On 08/29/2012 09:46 AM, Maarten Broekman wrote: > >> -Original Message- > >> Despite the statement of your objective it isn't clear to me what you > >> think you're going to achieve. My expectation would be a very large > >> incr

Re: [clamav-users] Generating signatures for malware

2012-08-29 Thread Michael Orlitzky
On 08/29/2012 09:46 AM, Maarten Broekman wrote: >> -Original Message- >> Despite the statement of your objective it isn't clear to me what you >> think you're going to achieve. My expectation would be a very large >> increase in the false positive rates if you attempt to use signatures >>

Re: [clamav-users] Generating signatures for malware

2012-08-29 Thread Maarten Broekman
> -Original Message- > Despite the statement of your objective it isn't clear to me what you > think you're going to achieve. My expectation would be a very large > increase in the false positive rates if you attempt to use signatures > modified in the way you describe. Can you be more sp

Re: [clamav-users] Generating signatures for malware

2012-08-29 Thread G.W. Haywood
Hi there, On Wed, 29 Aug 2012, Maarten Broekman wrote: Does anyone know of a tool that would take strings in a hex signature and turn them into appropriate wildcards? For instance, I want to strip out all the "http://"; and "https://"; and replace them with {7-8} Your suggested replacement d

Re: [clamav-users] clamav update from tar.gz

2012-08-29 Thread G.W. Haywood
Hi there, On Wed, 29 Aug 2012, n22e113 wrote: On 8/27/2012 08:17, infelectromed@infomed.sld.cu wrote: I have install clamav 0.96.5 from my ubuntu 10.04 repository but I want to upgrade to 0.97.5 Your problem is not unique as I had the same problem for months with Debian Lenny. Attempts

Re: [clamav-users] Form of clamscan invocation

2012-08-29 Thread G.W. Haywood
Hi there, On Wed, 29 Aug 2012, Jonathan Ryshpan wrote: ... thank you very much for your time and attention. Shucks. :) I've been getting a vast quantity of spam lately; Can you give us some numbers? Did this change suddenly or not? Is pacbell.net your only mail service provider? Are yo