[clamav-users] Adding a custom signature for spam

turgut kalfaoğlu turgut at kalfaoglu.com
Mon Nov 12 08:54:09 UTC 2018

Hello there. I was fed up with some repeated spam that was coming our 
way, and had the idea that it would be great if the clamd could stop 
these. (We use plesk with postfix+clamav)

So, I did something like this:

$ echo This is a text line from the annoying spam | sigtool --hex-dump 
 >> /var/lib/clamav/customsig.ndb

I also added this to the beginning of that line: Spam.kalfaoglu.net.1:0:*:

However, trying this out,

$ clamscan  badmail.txt
badmail.txt: OK
----------- SCAN SUMMARY -----------
Known viruses: 7192915
Engine version: 0.100.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 12.822 sec (0 m 12 s)

... does not yield to a detection.. what am I doing wrong?

Many thanks, -t

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20181112/031f955d/attachment.htm>

More information about the clamav-users mailing list