Additional signatures to use with ClamAV - ORF Forums

Additional signatures to use with ClamAV RSS Back to forum

1

Hi,

I have implemented ClamAV per the userguide, and everything appears to be working properly however I still get a bit of spam and would like some input on some additional signatures that folks are using that work and might be a little more agressive than the ones in the userguide.

Here's a quick link to the signatures on SaneSecurity's website.
http://sanesecurity.com/usage/signatures/

Thanks
Josh

by Josh 6 years ago
2

@Josh: We (at Vamsoft) had a mixed experience with third-party signatures the last time we used them a couple of years ago -- there have been a considerable amount of false positives, so in any case I recommend starting with those marked as Low Risk.

by Péter Karsai (Vamsoft) 6 years ago
(in reply to this post)

3

Peter,

Thanks for the feedback. I'll try starting with some of the lower risk signatures first. As I mentioned in this post here:
http://vamsoft.com/forum/topic/470/secondary-spam-toolprogram-or-additional-help-with-orf-config

I am struggling with continued spam from the same parties on a daily basis (same type of spam, same type of spamming strategy), but have been unable to come up with a solution that stops it. KrisztiƔn provided some good feedback and to my best knowledge I've implemented those changes. The no reverse name dns check has helped, but as mentioned, I've got the same type of spammers continuing on a daily basis. So any additionl thoughts are welcomed.

Thanks
Josh

by Josh 6 years ago
4

@Josh: Is this the type of spam you described in this thread: http://vamsoft.com/forum/topic/470/secondary-spam-toolprogram-or-additional-help-with-orf-config ? If yes, please see me response there.

by Péter Karsai (Vamsoft) 6 years ago
(in reply to this post)

5

Peter,

Yes, that is the type of spam I'm receiving.

by Josh 6 years ago

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2