[clamav-users] Adding a custom signature for spam

[turgut kalfaoğlu]

Hello there. I was fed up with some repeated spam that was coming our
way, and had the idea that it would be great if the clamd could stop
these. (We use plesk with postfix+clamav)

So, I did something like this:

$ echo This is a text line from the annoying spam | sigtool --hex-dump

/var/lib/clamav/customsig.ndb

I also added this to the beginning of that line: Spam.kalfaoglu.net.1:0:*:

However, trying this out,

$ clamscan  badmail.txt
badmail.txt: OK
----------- SCAN SUMMARY -----------
Known viruses: 7192915
Engine version: 0.100.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 12.822 sec (0 m 12 s)

... does not yield to a detection.. what am I doing wrong?

Many thanks, -t

[Steve Basford]

Post by turgut kalfaoğlu
Hello there. I was fed up with some repeated spam that was coming our
way, and had the idea that it would be great if the clamd could stop these.

Are these being detected with 3rd party signatures?

Post by turgut kalfaoğlu
$ echo This is a text line from the annoying spam | sigtool --hex-dump

Try -n

eg.

echo -n This is a text line from the annoying spam|sigtool --hex-dump
5468697320697320612074657874206c696e652066726f6d2074686520616e6e6f79696e67207370616d

echo This is a text line from the annoying spam|sigtool --hex-dump
5468697320697320612074657874206c696e652066726f6d2074686520616e6e6f79696e67207370616d0d0a

Note that line feed 0d0a etc. at the end of the signature, which may
cause it to fail.
--
Cheers,

Steve
Twitter: @sanesecurity

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.htm