[clamav-users] signature that penalizes for line length?

[Vincent Fox]

It's late and I should have thought this through better.
Thanks!

On 6/14/2014 1:05 AM, Al Varnell wrote:
> In general terms, ClamAV® looks for malware and not spam.  There are some additional “unofficial” signature databases that can be subscribed to and work with the ClamAV® scan engine, so I suggest taking a look at Sanesecurity <http://sanesecurity.com> to see if they have what you need.
>
> Steve runs things there and subscribes to this list so will probably have some more specific knowledge.
>
> -Al-
>
> On Sat, Jun 14, 2014 at 12:56 AM, Vincent Fox wrote:
>> Hi,
>>
>> We use ClamAV, and I have noticed a certain class of spam hitting us lately
>> that has VERY long final lines of garbage text.
>>
>> The reason I noticed it was the length exceeds 2048 characters, which trips
>> a problem in POP3 client downloads.
>>
>> Anyhow is there any signature that can be used to score and penalize
>> text/plain messages with excessively long lines?
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> http://www.clamav.net/support/ml