Re: [Clamav-users] Signature related question

2009-05-27 Thread Tomasz Kojm
On Wed, 27 May 2009 08:04:28 -0700 "Bill Landry" wrote: > Thanks, Tomasz, I will look into logical signatures, as well. Do you know > if using logical signature take more overhead to use than standard hex > signatures? They're comparable. -- oo. Tomasz Kojm (\/)\

Re: [Clamav-users] Signature related question

2009-05-27 Thread Bill Landry
> On Wed, 27 May 2009 06:52:17 -0700 > Dennis Peterson wrote: > >> Bill Landry wrote: >> > There has been some discussion on the Sanesecurity users list about >> > ClamAV signatures matching unintended words. For example, a signature >> > that is written to match "acebook . com" (remove the space

Re: [Clamav-users] Signature related question

2009-05-27 Thread Tomasz Kojm
On Wed, 27 May 2009 06:52:17 -0700 Dennis Peterson wrote: > Bill Landry wrote: > > There has been some discussion on the Sanesecurity users list about > > ClamAV signatures matching unintended words. For example, a signature > > that is written to match "acebook . com" (remove the spaces) would

Re: [Clamav-users] Signature related question

2009-05-27 Thread Bill Landry
Dennis Peterson wrote: > Bill Landry wrote: >> There has been some discussion on the Sanesecurity users list about >> ClamAV signatures matching unintended words. For example, a signature >> that is written to match "acebook . com" (remove the spaces) would also >> match "facebook . com". >> >> Is

Re: [Clamav-users] Signature related question

2009-05-27 Thread Dennis Peterson
Bill Landry wrote: > There has been some discussion on the Sanesecurity users list about > ClamAV signatures matching unintended words. For example, a signature > that is written to match "acebook . com" (remove the spaces) would also > match "facebook . com". > > Is there a way to delimit what c