[clamav-users] could it help...

[Arnaud Jacques]

Hello Jean-François,

> My question is, can I use the 30 that is not detected, have them pass 
> through VirusTotal and gradually upload them to the 
> www.clamav.net/reports/malware <http://www.clamav.net/reports/malware> 
> page.
>

You can use clamsubmit to submit a file. To submit 30 files to ClamAV 
you can create a bash script.
It is faster than using the webform on clamav website.
Syntax is :
clamsubmit -e your_email -N your_name -n the_file_to_submit


> So would it help to make clamav better or is it going to be just very 
> annoying and get myself banned....
>

As far as I know, it is OK to submit a lot of files to ClamAV team. I do 
it sometimes too.

> I sure would like to have clamav detect at least 90% of the lot.  It 
> would be a long process but my health is not good and I am stuck home 
> with nothing to do.  Doing that would at least make me feel useful a 
> little.
>

Yes, it will take time to ClamAV team to create signatures based on 
submitted samples.
If you want immediate better detection you can use 3rd party signatures 
for example :

https://www.securiteinfo.com/services/anti-spam-anti-virus/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml

https://sanesecurity.com/usage/signatures/

Maybe the best point is to submit samples to ClamAV that are not 
detected by anyone ?
Btw, be sure to submit *malwares* to ClamAV. Malware collections like 
VirusShare contains a lot of false positives...

-- 
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.44.39.76.46
E-mail : aj at securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom

Securiteinfo.com
La Sécurité Informatique - La Sécurité des Informations.
266, rue de Villers
60123 Bonneuil en Valois

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20180929/3251a08c/attachment.htm>