Re: [clamav-users] Malware/ransomware and Yara signatures with clamav

2017-05-14 Thread Alex
Hi, On Sat, May 13, 2017 at 1:32 PM, Alain Zidouemba wrote: > For "WannaCry", look for ClamAV signatures: > Win.Ransomware.WannaCry-* Are clamav users protected from this ransomware? Are there possible variants not yet detected? Is there anything further we need to do to protect ourselves, as it

Re: [clamav-users] Malware/ransomware and Yara signatures with clamav

2017-05-14 Thread Alain Zidouemba
To address WannaCry, look up signatures with the name: Win.Ransomware.WannaCry-* Re: email & WannaCry: http://blog.talosintelligence.com/2017/05/wannacry.html?showComment=1494655249347#c771405865891887102 Re: anything further we need to do to protect ourselves: "Organizations should ensure that

Re: [clamav-users] Malware/ransomware and Yara signatures with clamav

2017-05-14 Thread G.W. Haywood
Hi there, On Sun, 14 May 2017, Alex wrote: Are clamav users protected from this ransomware? To be clear about this, the current excitement is caused by a 'worm'. That means if vulnerable, network-connected systems are not protected from each other, for example by a firewall, the worm can prop

Re: [clamav-users] Malware/ransomware and Yara signatures with clamav

2017-05-14 Thread Joel Esler (jesler)
ClamAV isn't only used for mail. Clamwin and Immunet client will catch this. -- Sent from my iPhone > On May 14, 2017, at 12:42, G.W. Haywood wrote: > > Hi there, > >> On Sun, 14 May 2017, Alex wrote: >> >> Are clamav users protected from this ransomware? > > To be clear about this, the c

Re: [clamav-users] Malware/ransomware and Yara signatures with clamav

2017-05-14 Thread Cedric Knight
On 14/05/17 17:42, G.W. Haywood wrote: >> Are clamav users protected from this ransomware? Partially. Everyone agrees: * Check MS17-010 is applied on every Windows device you can - before tomorrow! I don't have access to samples, but ClamAV seems to be picking up some of Wcry/WanaCrypt0r/WannaC