[clamav-users] exception rule - help needed

[Al Varnell]

Just a guess, but perhaps by naming it daily.wbd it gets confused with the one that's embedded in daily.cvd.

I always name my file local.xxx.

-Al-

> On Jan 5, 2023, at 5:21 AM, newcomer01 via clamav-users <clamav-users at lists.clamav.net> wrote:
> 
> okay, now i found a permission issue.
> 
> Ubuntu sets the clamav-deamon and clamav-freshclam automatically to chmod 0644 (in /etc/init.d/) and this is completely wrong.
> 
> I have now set chmod 0755 to this files (must run as program) and now my wdb file is read by clamscan, but it noticed me, that this database is malformed.
> Now i have removed all new lines and comments, maybe this solve the issue - don't know now.
> 
> Is there a detailed explanation available how to have i format this .wbd file?
> I find unfortunately the clamav.net Docu is not detailed enough.
> 
> I create this wdb file in this way:
> 
> exec 3> /var/lib/clamav/daily.wdb
> echo 1>&3 "Some Line"
> echo 1>&3 "Some Line"
> echo 1>&3 "Some Line"
> exec 3>&-
> 
> 
> Von / From: Clamav User Mailinglist <mailto:clamav-users at lists.clamav.net>
> An / To: Clamav User Mailinglist <mailto:clamav-users at lists.clamav.net>
> Gesendet / Sent: Mittwoch, Januar 04, 2023 um 16:48 (at 04:48 PM) +0100
> Betreff / Subject: [clamav-users] Fwd: exception rule - help needed
> no one can help me?
> 
> 
> Von / From: Clamav User Mailinglist <mailto:clamav-users at lists.clamav.net>
> An / To: Clamav User Mailinglist <mailto:clamav-users at lists.clamav.net>
> Gesendet / Sent: Dienstag, Januar 03, 2023 um 20:03 (at 08:03 PM) +0100
> Betreff / Subject: [clamav-users] exception rule - help needed
> Hi @ all and happy new year!
> 
> I need help to create an exception rule for my Bank e-mails.
> 
> Currently, I have a "whitelist.wbd" file in the lib folder of clamav, but all of my rules seems not work.
> Please help me to get the expected result, and it is generally no way for me, to disable this checks for all.
> 
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://www.facebook.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://twitter.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://www.instagram.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://www.youtube.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://play.google.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> # LibClamAV info: Suspicious link found!
>> # LibClamAV info:   Real URL:    https://apps.apple.com
>> # LibClamAV info:   Display URL: https://mailing.sparkasse.de
>> #
>> X:(http:\/\/|https:\/\/)(.+)(facebook|twitter|instagram|youtube|play\.google|apps\.apple)(.+):(http:\/\/|https:\/\/)(.+)(sparkasse|sls\-direkt)\.de([\/?].*)?:20-
>> M:facebook.com:mailing.sparkasse.de
>> M:https://twitter.com:mailing.sparkasse.de
>> M:instagram.com:mailing.sparkasse.de
>> M:youtube.com:mailing.sparkasse.de
>> M:play.google.com:mailing.sparkasse.de
>> M:apps.apple.com:mailing.sparkasse.de
> 
> kind regards,
> Marc
> _______________________________________________
> 
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
> 
> https://docs.clamav.net/#mailing-lists-and-chat
> _______________________________________________
> 
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
> 
> https://docs.clamav.net/#mailing-lists-and-chat
> _______________________________________________
> 
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
> 
> https://docs.clamav.net/#mailing-lists-and-chat


         
Powered by Mailbutler <https://www.mailbutler.io/?utm_source=watermark&utm_medium=email&utm_campaign=watermark-variant-primary> - still your inbox, but smarter.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20230105/a05f1713/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4376 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20230105/a05f1713/attachment.p7s>