Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Kris Deugau
G.W. Haywood wrote: > Hi there, > > On Mon, 2 Nov 2015, Hajo Locke wrote: > >> ... It seems to be so easy for a php-programmer to generate infinite >> number of malwarefiles ... > > That's correct. > > Any .php file sent here goes straight to /dev/null without inspection. I can't say I've seen

Re: [clamav-users] negate part of signature

2015-11-02 Thread Dennis Peterson
Awesome news on the PCRE inclusion. Looking forward to that. dp On 10/29/15 4:13 PM, Alain Zidouemba wrote: FYI, PCRE support is coming in ClamAV 0.99. There is a release candidate here if you want to try it: http://www.clamav.net/downloads ___

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread G.W. Haywood
Hi there, On Mon, 2 Nov 2015, Hajo Locke wrote: ... It seems to be so easy for a php-programmer to generate infinite number of malwarefiles ... That's correct. Any .php file sent here goes straight to /dev/null without inspection. -- 73, Ged. ___

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Hajo Locke
Hello, Am 02.11.2015 um 11:54 schrieb Alain Zidouemba: I believe the issue is around 5d2e{-11}*6973 <6973736574> Remove the * and try again. ahh! hmm, didnt saw this. Works now. Thank you. do you think a signature like this is very reliable? It seems to be so easy for a php-programmer to g

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Alain Zidouemba
I believe the issue is around 5d2e{-11}*6973 <6973736574> Remove the * and try again. -Alain On Nov 2, 2015, at 5:24 AM, Hajo Locke wrote: 5d2e{-11}*6973 ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://

[clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Hajo Locke
Hello, again i have to create signatures for some difficult short files. Using this files hacked CMS do what you want. Examples are here: http://pastebin.com/ruxdmpNz Number of files seems infinite, there always are different names of variables. Also length of variables and spaces between text