ClamAV Community Signature Contest Winner for August and September 2016

We'd like to congratulate our ClamAV Community Signature contest winner for the months of August and September: Askar Dyussekeyev

Congratulations and thank you for your contributions!

For more information on how you can get involved in the monthly contest and try and win your ClamAV swag, please see my post on the blog. We'll soon be revamping our signature contest (prizes included) so please continue to check back with our blog site!

Once again, thank you, and congratulations to Askar!

ClamAV 0.99.3 Moving To Visual Studio 2015

With the upcoming release of ClamAV 0.99.3 comes an important change for Windows users interested in compiling ClamAV from source. Version 0.99.3 marks the switch from Visual Studio 2013 (and earlier) to Visual Studio 2015. Among other things, the benefits of this switch include improved C99 compatibility and much less restrictive licensing for individuals, educators, OSS contributors, and small teams.

Please be aware, this update will break compatibility when compiling ClamAV on older versions of Visual Studio. Additionally, building the Installation Setup Projects requires a Microsoft-provided plugin which provides the necessary compilation support.

Finally, we’d like to give a shout out to Keith Jones for the initial pull request.

ClamAV Community Signature Contest Winner for July 2016

We'd like to congratulate our July winner of the monthly ClamAV Community Signature contest: Askar Dyussekeyev

Congratulations and thank you for your contributions!

For more information on how you can get involved in the monthly contest and try and win your ClamAV swag, please see my post on the blog.

Once again, thank you, and congratulations to Askar!

CRDF Joins the ClamAV Signature Partner Program!

We'd like to welcome CRDF to the ClamAV Signature Detection Partner Program!

The CRDF is the first 3rd party Signature house we've integrated into the program.  Their signatures are now being distributed to all ClamAV Virus database subscribers, officially signed by us, and distributed through the official mirror system.

If you visit ClamAV.net and file a false positive report against one of CRDF's signatures, they will also receive a copy of the False positive report at the same time we do.

You can keep abreast of who we bring into the Partner program on our Contact page on ClamAV.net, and we'll announce each new on here, on the ClamAV Blog.  We have several more we are working on right now.

If you write ClamAV detection, and are interested in having it distributed to the entire ClamAV community, and receive donations and false positive reports from your signatures, please see our blog post about how to join the program.

ClamAV Community Signature contest winner for June 2016

We'd like to congratulate our June winner of the monthly ClamAV Community Signature contest:   Arnaud Jacques!

Congratulations and thank you for your contributions!

For more information on how you can get involved in the monthly contest and try and win your ClamAV swag, please see my post on the blog.

Once again, thank you, and congratulations to Arnaud!

Regarding the Use of ClamAV Daemon's TCP Socket

Recently, a tweet and subsequent blog post on Errata Security describe some features of the ClamAV daemon (clamd) that may be misused toward information disclosures and denial of service attacks. We wanted to take the opportunity to inform the ClamAV community about the clamd configuration that may lead to these issues along with the steps and options for using clamd securely.

clamd is an optional feature of ClamAV providing local or remote host access to ClamAV's scanning engine through the clamd protocol. Several ClamAV commands communicate with clamd using the clamd protocol: clamdscan for virus scanning, clamdtop for clamd resource monitoring, and freshclam, when used in conjunction with clamd, to notify clamd to reload the virus database. Clamav-milter and some third party programs use the clamd protocol as well. The clamd protocol is fully described in the clamd man-page.

This feature, off by default, requires manual configuration.  In order to use clamd, an installation must select a socket type in clamd configuration file, clamd.conf. The installation has two choices for the type of socket. Their configuration parameter names are LocalSocket and TCPSocket. LocalSocket, available on Unix based systems, is not vulnerable to the information disclosure or the DoS. However, all of the programs communicating with clamd must reside on the same host system with clamd. The TCPSocket option enables communication from remote hosts, but care must be taken to protect the ingress network interfaces. An additional clamd parameter, TCPAddr, may be used to designate which network interfaces will accept clamd TCP connection requests. Those interfaces need to be protected, such as though the use of firewall or other network security mechanisms. This will ensure that unwanted clamd requests will be blocked. Additional information on the clamd configuration parameters may be found in the clamd.conf man-page and in the sample clamd configuration file distributed with ClamAV.

Finally, note that the clamscan command, and other software using the libclamav API directly, do not use clamd and therefore are not affected by this configuration.

ClamAV Signatures

As many of you know, over the past several years, we’ve been retooling the entire backend of ClamAV.net’s signature management system to handle a more streamlined release method and signature generation system.  Now that this work is complete, we’re reaching out to those of you in our ClamAV community that manage some form of third party ClamAV signature distribution systems.

We would like to potentially incorporate the feeds that you are producing into the official feed coming from our mirror network at ClamAV, out to the community.  We are going to ensure proper attribution for everyone’s work within the signature name.  

We haven’t determined what this will look like, but what we would like to see is the name of the feed, not only in the signature name, but a table to be maintained on ClamAV.net ensuring the proper mapping from signature name to your website (and donation system, if you have one).

We would be responsible for the “dropping” of a False positive prone ClamAV sig from the official db, however, our intention is to notify you of the FP on your sig when it is reported to us at the same time we are notified, so that the signature can be fixed.

This process is ongoing but if you are interested in being added to the list of those already contributing or have additional questions, please contact me at bcouncil@cisco.com. 

Your comments and concerns are also welcome.  

Create your Own Anti-Virus Signatures with ClamAV

Today I came across this older blog post (almost 10 years old at this point!) about a simple method you can use to create your won Anti-Virus signatures with ClamAV.

The article has a nice walk through of how to dump an attachment out of an email, how to write a simple ndb signature to detect it, and how to deploy it.  I thought this was fairly simple and well done, so I wanted to share.

If you are interested in creating your own detection, this article is worth checking out.

http://blog.adamsweet.org/?p=250

If you want to proceed a step further and submit those signatures back to us, we'll take a look as well, and if you submit the most in a month, we'll send you some nice swag!

ClamAV Community Signature contest winner for May, 2016

We'd like to congratulate our May winner of the monthly ClamAV Community Signature contest:   Arnaud Jacques!

Congratulations and thank you for your contributions!

For more information on how you can get involved in the monthly contest and try and win your ClamAV swag, please see my post on the blog.

Once again, thank you, and congratulations to Arnaud!

Reminder: EOL for ClamAV 0.97 is tomorrow! (June 1st)

As a reminder from our post back on May 20th, EOL for ClamAV 0.97 is tomorrow (June 1st).  We'll be removing this version from our test bed and will no longer ensure that signatures work on that version.

If you are on a 0.97 version, please make sure you upgrade as soon as possible.  The current version is available on ClamAV.net.

Thanks.