[clamav-users] concerning foxhole databases

[Rajesh M]

----- Original Message -----
From: Steve Basford [mailto:steveb_clamav at sanesecurity.com]
To: clamav-users at lists.clamav.net
Sent: Thu, 23 Apr 2015 12:29:39 +0100
Subject: Re: [clamav-users] concerning foxhole databases


On Thu, April 23, 2015 12:03 pm, Rajesh M wrote:

> i am using foxhole_all.cdb  foxhole_filename.cdb  foxhole_generic.cdb but
> does not work
>
> how do i block .cab extension even if they are within zip or rar or 7z
> files.

Hi Rajesh

In your sample...a-to-z_moving_and_delivery.zip

Using database foxhole_all.cdb:

a-to-z_moving_and_delivery.zip:
Sanesecurity.Foxhole.Cab_scr.UNFFICIAL FOUND

Using database phish.ndb:

a-to-z_moving_and_delivery.zip:
Sanesecurity.Malware.24866.ExeHeur.Cab.UNOFFICIAL FOUND

Looks like something isn't working at your end.

If you clamscan --database=foxhole_all.cdb a-to-z_moving_and_delivery.zip
does it work?

If not, might need a debug output from above command

Cheers,

Steve
Web : sanesecurity.com
Blog: sanesecurity.blogspot.com

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml


hi

i am using a compiled version for qmailtoaster

i do not use any other sanesecurity database files other than foxhole.

if i send an email with an exe file inside a zip file then i get the error

your email was rejected because it contained sanesecurity.foxhole.zip_exe.
So foxhole is working.

however if i first have a zip file then cab file then exe inside then as in case of a-to-z_moving_and_delivery.zip it does not get detected.

OUTPUT WITH .scr inside cab inside zip

# clamscan --database=/var/lib/clamav/foxhole_all.cdb a-to-z_moving_and_delivery.zip
a-to-z_moving_and_delivery.zip: OK

----------- SCAN SUMMARY -----------
Known viruses: 116
Engine version: 0.98.6
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.09 MB
Data read: 0.02 MB (ratio 6.00:1)
Time: 0.025 sec (0 m 0 s)


OUTPUT WITH .exe inside  .zip

# clamscan --database=/var/lib/clamav/foxhole_all.cdb a-to-z_moving_and_delivery1.zip
a-to-z_moving_and_delivery1.zip: Sanesecurity.Foxhole.Zip_exe.UNOFFICIAL FOUND

----------- SCAN SUMMARY -----------
Known viruses: 116
Engine version: 0.98.6
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.02 MB (ratio 0.00:1)
Time: 0.011 sec (0 m 0 s)


could you kindly let me have the link to download the latest foxhole database ie the direct link that will work with .98.6

rajesh