Malware Research Group tests say Immunet is #1

Check out this test over at the Malware Research Group.  The MRG tests most of the top anti-malware software vendors for coverage and features and it turns out as a result of this particular test, that MRG rates that Immunet comes out on top!

Check out the test results here.

PCWorld writes about ClamAV and Immunet

It's great to see the news coming out about our ClamAV 3.0 product for Windows, seems Keir Thomas of PCWorld wrote the article linked below. Here's a couple of choice quotes:

"The key new feature in version 3 is offline scanning. Because of its cloud nature, ClamAV for Windows ideally requires an Internet connection in order to check files against virus definitions, but with version 3 the ClamAV engine and virus definitions are also held locally, so virus scans are possible when the Internet isn't present."

"When I ran the software for testing purposes it told me it protected against just over 19 million threats, and that around 800,000 people were connected to the Immunet Protect cloud alongside me. It's difficult to argue with such figures."

The article states that they don't know when the final release of ClamAV 3.0 for Windows will be released, but we'll tell you that it will be soon, and we'll let you know when it is ready!

ClamAV Promises Free Antivirus App For Businesses

Are you speaking about ClamAV?

Are you attending a Security Conference where there is a presentation on ClamAV?
Are you presenting at a Security Conference about ClamAV?

Email me!  I'd like to have a running list of Security Conferences with presentations about our OpenSource technologies.  We'll maintain it on the website and help publicize the speaking engagement for you!

Thanks!

ClamAV 3.0 for Windows Open Beta

The public beta for ClamAV 3.0 for Windows, which includes full integration of the ClamAV engine into the Immunet Protect product is now open. If you are interested in playing with ClamAV 3.0 for Windows please check out the following link:

http://forum.immunet.com/index.php?/topic/562-clamav-for-windows-beta-clamlib-integration

The download links are here:

(32 Bit Systems) - http://www.clamav.net/win32/ClamAVWindowsSetup-beta-32.exe
(64 Bit Systems) - http://www.clamav.net/win32/ClamAVWindowsSetup-beta-64.exe

Main feature overview:

• ClamAV 0.96.5 libraries for real-time scanning and offline scanning
• Customizable signatures support and signature creation UI
• Wildcard exclusions - specifically so we can exclude Thunderbird's %TEMP%\nsmail*.tmp
• Unicode bug fixes
• Bug fix for user's getting in a disconnected state

A few things to remember

Because this is a Beta 1:

• It is strongly recommended that you test on a VM
• See https://www.clamav.net/bugzilla and
• http://forum.immunet.com/index.php?/topic/562-clamav-for-windows-beta-clamlib-integration for any additional known defects.

Things to try out:

1. The SigUI - This allows you to create your own ClamAV signatures and load them into the engine. Its both a GUI, and a command line tool. Documentation is available here: http://support.immunet.com/tiki-read_article.php?articleId=24
2. Writing ClamAV signatures documentation is here: http://www.clamav.net/doc/latest/signatures.pdf

Reporting bugs :

Please report bugs at https://wwws.clamav.net/bugzilla. Remember to attach a run of the System Diag Tool to help speed up fixing the problem. (its located in the Program Folder for ClamAV for Windows).
It drops a zip file on the desktop.

Known issues:
1. Binaries are still labeled 2.0
2. Scan history screen contains duplicate entries.

The ClamAV Blog is back!

After a hiatus of, wow, almost 2 years, the ClamAV blog is back!

Here we'll post news about our newest releases of ClamAV, news surrounding the project, technical tips, and how you can better use it to protect your computer and network.

If you have any feedback or suggestions of topics you'd like to see written about on the ClamAV blog, don't hesitate to email me!

Thanks for supporting ClamAV!  We look forward to a great 2011.

Joel Esler
jesler [at] sourcefire [dot] com
Manager, OpenSource Community

New Clamav-milter for ClamAV 0.95

ClamAV 0.95, which is currently scheduled for release by Sourcefire in March 2009, will include a redesigned and completely rewritten clamav-milter.

Developers and keen users of ClamAV may have noticed that the version of clamav-milter within the SVN repository has changed a lot. We want to let you know what we’ve done and why.

The most notable difference in the new clamav-milter is that the internal mode has been dropped which means that now you will need to run clamd. This has not only allowed us to keep clamav-milter compact and readable, but also it avoids a lot of code duplication. With the old clamav-milter, internal mode was almost the same as having an outdated clamd with a milter interface because we were not keeping the code up-to-date with clamd’s API.

The second important difference is that now clamav-milter has its own configuration and log files that replace the large number of command line switches in the previous version. To ease the difficulty of learning another configuration file, the new clamav-milter comes with a program that will generate a configuration file from your existing command line options and clamd.conf file.

Some features are no longer supported:

• Notifications
• Black-listing
• Phish false positive prevention by use of a subset of SPF
• Scanning information is no longer added to the email headers by default
• Scanning and other information can no longer be added to message bodies

So Why Has This Been Done?

Nigel Horne, the program’s previous author, is no longer a member of ClamAV’s engineering team – he is now ClamAV’s product manager. The milter program did not support many new features included within ClamAV and hence clamav-milter was starting to lag behind and bugs were not being addressed. The code was over 7500 lines and we felt it was a great opportunity to rewrite the code from scratch to be more closely coupled with the rest of ClamAV.

As a result we have been able to support new features, including:

• Clamav-milter can now run as a completely unprivileged user (e.g. nobody)
• Quarantine has been reworked to use the native milter interface on later versions of Sendmail and Postfix that support it
• White-listing now uses regular expressions, replacing strict matching
• Support for Postfix has been added in addition to Sendmail
• Full IPv6 support.

The new milter’s configuration file is designed to be consistent with the configuration file for clamd, allowing you to fine-tune specific configurations and to route log messages to a dedicated file.

The new milter supports load balancing to copies of clamd in a round-robin fashion. Should one instance of clamd temporarily go down, clamav-milter will issue probe requests every few minutes and the instance will be re-entered into the pool as soon as it becomes available again. Scan requests to remote clamds are performed via the STREAM command, while requests to a local scanner are (preferably) sent via a FILDES command (file descriptor passing over a UNIX socket). This allows systems’ administrators to run clamav-milter and clamd as different users.

And last, but not least, if you prefer, you can continue to use the old version which is kept under …/contrib/old-clamav-milter.
The new clamav-milter will supersede the old one in ClamAV 0.95. Whilst the previous version will still be available, it will no longer be supported.

Installation Instructions

Run ./configure --enable-milter and make as usual.

There are two ways to configure the new clamav-milter:

• Use the example clamav-milter.conf that we have provided as a template for your configuration. It's well documented, but if something's not clear please report it to bugs.clamav.net and we’ll fix it.
• Run the make-clamav-milter-conf.pl script with the same run-time arguments you currently pass to clamav-milter and a configuration file will be generated automatically.

Known Issues

The white-list format now uses regular expressions; the old format was a list of strings wrapped in “<>”, the white-list file will therefore need to be edited. We plan to add automated conversion of the file to later versions of the configuration converter script, in the meantime the file will need to be edited by hand.

The round-robin clamd selection requires more work. It works well with either one or a high number of instances of clamd, but the round-robin strategy is limited when the number of scanners is as low as two or three.

And Finally…

The new milter is currently a work in progress. Although we’ve tested it with several hundred GBs of emails, real-life situations are usually more complex than inside the lab. We’re working hard to ensure that clamav-milter is portable to more operating systems.

Please send us your feedback on the new program by adding a comment to this blog; we’re really interested to know what you think!

Catching Swizzor

Users of ClamAV’s cutting edge SVN release may have noticed that on 2^nd December we added heuristic support to catch the Swizzor Trojan.

Released in late 2004, Swizzor downloads and installs Adware and other Trojans and installs them on the infected machine. Just browsing websites can infect your PC if it is not properly patched or protected.

You may have been wondering why we’ve decided to include the heuristic algorithm in the engine rather than continue writing signatures to catch it. Swizzor is clever in the way that it changes itself so often and can mimic standard (and therefore clean) Windows programs. There are nearly 1000 signatures for Swizzor in the ClamAV signature database, yet nearly four years after it was written we are still receiving undetected samples.

By writing an algorithm to detect Swizzor and including that algorithm into the anti-virus engine of ClamAV we will save a lot of effort writing signatures, and new variants will be caught as soon as they are created. So far we’ve found no sign of false positives from the algorithm.

The variant of Swizzor that has been in the wild since early in 2008 has proven particularly difficult to find because it adds strings throughout itself that are almost random. We hit upon the idea of detecting Swizzor’s variants by analyzing these strings in the program. Although the strings are gibberish, somehow they looked to us as though they are automatically generated. At first we thought these strings, looking almost random, would be impossible to detect; but after some careful examination of the strings’ ngrams we were able quickly to generate a heuristic rule by building a decision tree using data mining.

The algorithm built into ClamAV shows over 83% detection rate on Trojan.Swizzon.Gen with no false positives, but the battle carries on to improve the detection rates even further.