Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-04-08 Thread Bill Landry
Török Edwin wrote: > On 2009-04-08 22:40, Bill Landry wrote: >> Török Edwin wrote: >> >> Hi Edwin, >> >> >>> For 0.95.1 I was thinking about something like this (not yet implemented): >>> S:X:F5B73C1339C8C9B2B9537F129D63F4ECA16E0346819FB417E643CDA7B9EFA09A >>> >> I am now running: >> >> cla

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-04-08 Thread Török Edwin
On 2009-04-08 22:40, Bill Landry wrote: > Török Edwin wrote: > > Hi Edwin, > > >> For 0.95.1 I was thinking about something like this (not yet implemented): >> S:X:F5B73C1339C8C9B2B9537F129D63F4ECA16E0346819FB417E643CDA7B9EFA09A >> > > I am now running: > > clamscan --version > ClamAV 0.95.

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-04-08 Thread Bill Landry
Török Edwin wrote: Hi Edwin, > For 0.95.1 I was thinking about something like this (not yet implemented): > S:X:F5B73C1339C8C9B2B9537F129D63F4ECA16E0346819FB417E643CDA7B9EFA09A I am now running: clamscan --version ClamAV 0.95.1/9214/Wed Apr 8 09:46:42 2009 However, I tried this syntax in a fi

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-24 Thread Bill Landry
Török Edwin wrote: >> Ok, I've reviewed the phishsigs_howto.pdf, but have failed in my efforts >> to create a whitelist entry based on the hash > > "whitelist entry based on hash = per-entry whitelisting" I was referring > to below, that will be in 0.95.1 > >> (rather than using a >> regular ex

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-24 Thread Török Edwin
On 2009-03-24 17:04, Bill Landry wrote: > Török Edwin wrote: > > >> For whitelisting lada.cc you can use either: >> X:(.+\.)?lada.cc([/?].*)?:(.+\.)?lada.cc([/?].*)? >> >> Or this one (but it will also whitelist URL mismatches from lada.cc to >> anything, not recommended): >> X:(.+\.)?lada.cc([/

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-24 Thread Bill Landry
Török Edwin wrote: > For whitelisting lada.cc you can use either: > X:(.+\.)?lada.cc([/?].*)?:(.+\.)?lada.cc([/?].*)? > > Or this one (but it will also whitelist URL mismatches from lada.cc to > anything, not recommended): > X:(.+\.)?lada.cc([/?].*)?:.+ > > Or any other regular expression that w

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-24 Thread Török Edwin
On 2009-03-23 23:27, Bill Landry wrote: > Török Edwin wrote: > > >> They can be whitelisted by using .wdb entries [1], which allows you to >> use a POSIX regular expressions to whitelist any URL. >> (the original URL, not the hash). >> >> Since the entries in safebrowsing.cld change often whitel

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-23 Thread Bill Landry
Török Edwin wrote: > They can be whitelisted by using .wdb entries [1], which allows you to > use a POSIX regular expressions to whitelist any URL. > (the original URL, not the hash). > > Since the entries in safebrowsing.cld change often whitelisting based on > position in the .cld wouldn't work

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-19 Thread Bill Landry
Török Edwin wrote: > On 2009-03-19 23:38, Bill Landry wrote: >> Török Edwin wrote: >> >>> On 2009-03-19 22:54, Bill Landry wrote: >>> Along the same vein as my last question, again, clamd.log reports: Database correctly reloaded (1159852 signatures) However, "sig

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-19 Thread Török Edwin
On 2009-03-19 23:38, Bill Landry wrote: > Török Edwin wrote: > >> On 2009-03-19 22:54, Bill Landry wrote: >> >>> Along the same vein as my last question, again, clamd.log reports: >>> >>>Database correctly reloaded (1159852 signatures) >>> >>> However, "sigtool --list-sigs" only lists 6

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-19 Thread Bill Landry
Török Edwin wrote: > On 2009-03-19 22:54, Bill Landry wrote: >> Along the same vein as my last question, again, clamd.log reports: >> >>Database correctly reloaded (1159852 signatures) >> >> However, "sigtool --list-sigs" only lists 696491 signatures. It looks >> to me like it is listing a com

Re: [Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-19 Thread Török Edwin
On 2009-03-19 22:54, Bill Landry wrote: > Along the same vein as my last question, again, clamd.log reports: > >Database correctly reloaded (1159852 signatures) > > However, "sigtool --list-sigs" only lists 696491 signatures. It looks > to me like it is listing a combination of Official and Un

[Clamav-users] ClamAV 0.95rc2 - 1159852 signatures vs sigtool reporting 696491

2009-03-19 Thread Bill Landry
Along the same vein as my last question, again, clamd.log reports: Database correctly reloaded (1159852 signatures) However, "sigtool --list-sigs" only lists 696491 signatures. It looks to me like it is listing a combination of Official and Unofficial signatures, but obviously not listing ALL