On Aug 20, 2012, at 6:46 AM, Henri Salo wrote:
> Is there a way to configure ClamAV to scan also files with starting
> GIF87a/GIF89a? We get attacks like this daily.
I assume you mean detecting PHP files with that at the beginning?
--
Joel Esler
Senior Research Engineer, VRT
OpenSource Commu
> -Original Message-
> From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-
> boun...@lists.clamav.net] On Behalf Of Henri Salo
> Subject: [clamav-users] Problems detecting PHP bots
>
> Hello,
>
> Is there a way to configure ClamAV to scan also file
Hello,
Is there a way to configure ClamAV to scan also files with starting
GIF87a/GIF89a? We get attacks like this daily.
fgeek@example:~/samples-2012-05-09$ clamdscan x.php*
/home/fgeek/samples-2012-05-09/x.php: OK
/home/fgeek/samples-2012-05-09/x.php.2: PHP.Bot FOUND
--- SCAN SUMMARY
