[clamav-users] could it help...

[Jean-Francois Tasse]

Hello everyone, I am new to the users list. I have search in some of the past archives about this subject and I cannot seem to find anything similar.


Long story short, I am testing clamav on linux against viruses that is from http://virusshare.com/ more precisely the ones aimed at Linux.


Out of 100 infected files, clamav only see 70 of it.


My question is, can I use the 30 that is not detected, have them pass through VirusTotal and gradually upload them to the www.clamav.net/reports/malware<http://www.clamav.net/reports/malware> page.


So would it help to make clamav better or is it going to be just very annoying and get myself banned....


I sure would like to have clamav detect at least 90% of the lot. It would be a long process but my health is not good and I am stuck home with nothing to do. Doing that would at least make me feel useful a little.


my email: ***@hotmail.com


JF

P.S. sorry english is not my first language

[Al Varnell]

I suspect that somebody from the ClamAV signature team will jump on here when they get a chance to make arrangements for you to submit all 30 samples directly, without your having to go to all that trouble, so hang on for a bit. Probably doesn’t help that it's at the start of the weekend.

Sent from my iPad

-Al-

> On Sep 28, 2018, at 16:22, Jean-Francois Tasse <***@hotmail.com> wrote:
>
> Hello everyone, I am new to the users list. I have search in some of the past archives about this subject and I cannot seem to find anything similar.
>
> Long story short, I am testing clamav on linux against viruses that is from http://virusshare.com/ more precisely the ones aimed at Linux.
>
> Out of 100 infected files, clamav only see 70 of it.
>
> My question is, can I use the 30 that is not detected, have them pass through VirusTotal and gradually upload them to the www.clamav.net/reports/malware page.
>
> So would it help to make clamav better or is it going to be just very annoying and get myself banned....
>
> I sure would like to have clamav detect at least 90% of the lot. It would be a long process but my health is not good and I am stuck home with nothing to do. Doing that would at least make me feel useful a little.
>
> my email: ***@hotmail.com
>
> JF
> P.S. sorry english is not my first language
>
> _______________________________________________
> clamav-users mailing list
> clamav-***@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml

[Jean-Francois Tasse]

Thanks a lot 😊


JF

________________________________
De : clamav-users <clamav-users-***@lists.clamav.net> de la part de Al Varnell <***@mac.com>
Envoyé : 28 septembre 2018 19:39:58
À : ClamAV users ML
Objet : Re: [clamav-users] could it help...

I suspect that somebody from the ClamAV signature team will jump on here when they get a chance to make arrangements for you to submit all 30 samples directly, without your having to go to all that trouble, so hang on for a bit. Probably doesn’t help that it's at the start of the weekend.

Sent from my iPad

-Al-

On Sep 28, 2018, at 16:22, Jean-Francois Tasse <***@hotmail.com<mailto:***@hotmail.com>> wrote:


Hello everyone, I am new to the users list. I have search in some of the past archives about this subject and I cannot seem to find anything similar.


Long story short, I am testing clamav on linux against viruses that is from http://virusshare.com/ more precisely the ones aimed at Linux.


Out of 100 infected files, clamav only see 70 of it.


My question is, can I use the 30 that is not detected, have them pass through VirusTotal and gradually upload them to the www.clamav.net/reports/malware<http://www.clamav.net/reports/malware> page.


So would it help to make clamav better or is it going to be just very annoying and get myself banned....


I sure would like to have clamav detect at least 90% of the lot. It would be a long process but my health is not good and I am stuck home with nothing to do. Doing that would at least make me feel useful a little.


my email: ***@hotmail.com<mailto:***@hotmail.com>


JF

P.S. sorry english is not my first language


_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net<mailto:clamav-***@lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Arnaud Jacques]

Hello Jean-François,

> My question is, can I use the 30 that is not detected, have them pass
> through VirusTotal and gradually upload them to the
> www.clamav.net/reports/malware <http://www.clamav.net/reports/malware>
> page.
>

You can use clamsubmit to submit a file. To submit 30 files to ClamAV
you can create a bash script.
It is faster than using the webform on clamav website.
Syntax is :
clamsubmit -e your_email -N your_name -n the_file_to_submit


> So would it help to make clamav better or is it going to be just very
> annoying and get myself banned....
>

As far as I know, it is OK to submit a lot of files to ClamAV team. I do
it sometimes too.

> I sure would like to have clamav detect at least 90% of the lot.  It
> would be a long process but my health is not good and I am stuck home
> with nothing to do.  Doing that would at least make me feel useful a
> little.
>

Yes, it will take time to ClamAV team to create signatures based on
submitted samples.
If you want immediate better detection you can use 3rd party signatures
for example :

https://www.securiteinfo.com/services/anti-spam-anti-virus/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml

https://sanesecurity.com/usage/signatures/

Maybe the best point is to submit samples to ClamAV that are not
detected by anyone ?
Btw, be sure to submit *malwares* to ClamAV. Malware collections like
VirusShare contains a lot of false positives...

--
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.44.39.76.46
E-mail : ***@securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom

Securiteinfo.com
La Sécurité Informatique - La Sécurité des Informations.
266, rue de Villers
60123 Bonneuil en Valois