[Community-sigs] VBS signature submission

[Arnaud Jacques]

Hello Jean-Baptiste,


> I just created a signature for detecting small vbs in an email :
> 
> PUA.Win.malware.vbs.mail:CL_TYPE_MAIL:1000-10485760:^.*\.vbs$:100-1000:100-1000:0:0:*:
> 
> I tagged it as PUA but for some reason it detects event if I pass --detect-pua=no to clamscan, if someone can help ?

As far as I know, --detect-pua switch only applied to official 
signatures from ClamAV.

-- 
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.60.47.09.81
E-mail : aj at securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom
Writing signatures for ClamAV antivirus since 2006