Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-03 Thread Al Varnell
On Tue, Nov 03, 2015 at 10:06 AM, G.W. Haywood wrote: > > Hello again, > > On Tue, 3 Nov 2015, Kris Deugau wrote: > >> Customers will get very unhappy if you blindly delete all PHP files from >> their webhosting account... > > I don't remember suggesting that. > > My point is that ClamAV is d

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-03 Thread G.W. Haywood
Hello again, On Tue, 3 Nov 2015, Kris Deugau wrote: Customers will get very unhappy if you blindly delete all PHP files from their webhosting account... I don't remember suggesting that. My point is that ClamAV is designed to look for known threats. The OP is looking for unknown threats. I

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-03 Thread Hajo Locke
Hello, Am 02.11.2015 um 19:08 schrieb Kris Deugau: G.W. Haywood wrote: Hi there, On Mon, 2 Nov 2015, Hajo Locke wrote: ... It seems to be so easy for a php-programmer to generate infinite number of malwarefiles ... That's correct. Any .php file sent here goes straight to /dev/null without

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Kris Deugau
G.W. Haywood wrote: > Hi there, > > On Mon, 2 Nov 2015, Hajo Locke wrote: > >> ... It seems to be so easy for a php-programmer to generate infinite >> number of malwarefiles ... > > That's correct. > > Any .php file sent here goes straight to /dev/null without inspection. I can't say I've seen

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread G.W. Haywood
Hi there, On Mon, 2 Nov 2015, Hajo Locke wrote: ... It seems to be so easy for a php-programmer to generate infinite number of malwarefiles ... That's correct. Any .php file sent here goes straight to /dev/null without inspection. -- 73, Ged. ___

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Hajo Locke
Hello, Am 02.11.2015 um 11:54 schrieb Alain Zidouemba: I believe the issue is around 5d2e{-11}*6973 <6973736574> Remove the * and try again. ahh! hmm, didnt saw this. Works now. Thank you. do you think a signature like this is very reliable? It seems to be so easy for a php-programmer to g

Re: [clamav-users] Difficult malwarefiles - signature too short

2015-11-02 Thread Alain Zidouemba
I believe the issue is around 5d2e{-11}*6973 <6973736574> Remove the * and try again. -Alain On Nov 2, 2015, at 5:24 AM, Hajo Locke wrote: 5d2e{-11}*6973 ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://