]]>
]]>
]]>You can validate that you’re having this particular issue by a number of ways:
If you are expereincing the problem, please do the following: Stop the freshclam daemon if it’s running, delete both mirrors.dat and daily.cvd, then restart the freshclam daemon. Freshclam will then download a new daily.cvd and will be up-to-date.
We apologize for any inconvenience this has caused and thank you for using ClamAV. If you have any further issues, please send a message to the ClamAV user’s list or contact us via IRC.
mirrors.dat file in their database directory to force a reset of mirror selection.We’ve put in place a workflow that will prevent issues like this from popping up. A full change-management process is in place, with an emphasis on peer-reviewed planning, comprehensive test plans and appropriate personnel assignments. Change plans will be approved by a senior administrator, a ClamAV developer and a representative from the analyst team.
For the convenience of our mirror providers, there is now a set maintenance window for routine changes: Monday 5pm EST through midnight EST. As always, we will aim to notify mirror providers a week in advance of any change. In the case of emergent issues, a different time or a shorter notification may be required.
We apologize for any inconvenience caused by the problems outlined in this post. We will continue to review our processes to ensure that we are providing the best experience for both our users and our mirror providers.
]]>Microsoft has its own public key infrastructure (PKI). There are four trusted root certificate authorities: two by Microsoft, Thawte, and Verisign. Microsoft’s own executables for Windows are signed.
Authenticode At Work
First, we need to dump the certificate chain so that we can find the certificate to revoke. You can tell ClamAV to dump the certificate chain to stderr by passing -dumpcerts to clamscan. You will then match the certificate that is dumped with the public key of the lowest certificate in the chain that Windows shows. Windows shows a few bytes before the public key actually starts. Don’t worry, if that confuses you, I have screenshots:
Windows Certificate Information
Validating and Dumping Authenticode Certificate Information via ClamAV
Certificate revocation entries go into a .crtdb file in your ClamAV database directory. Its format is as follows: name;trusted;subject;serial;pubkey;exponent;codesign;timesign;certsign;notbefore;comment[;minFL[;maxFL]]
Where:
Descriptive name here;0;fe72355be4b6893d8e5b628d1a9ae8863d202b6f;a58d94ce010afa9865e732870971428768c92d64;ba0532ff862861cfaf8c22601fe479e3697b6ab94ff01c3254d105018c93bdb47f4c3fc1fb1d20172c46a727fb589f310cf6b081517ee472d145dfd4939c7d4652aad06c3ee6722f15703e88bbd8bc4d56fe7030b21f105fa9817b625103273caf46072628207e81bc13ac6ba18cdd3e93b97c9761730eb14ce36464cc997075;010001;1;0;0;0;
After adding that revocation entry to our certs database, ClamAV now flags the sample as a virus:
clamscan Reporting Virus
]]>
One of the best features of ClamAV is the openness of the signatures database. There are very few anti-malware products out there that will allow you see exactly how a signature is constructed and let you use your own custom signatures. We strive to provide the best protection we can to our users through the official signature releases we provide several times a day. However, the nature of our field makes it that you will at some point (if you haven’t already) come across malware for which there are no official signatures to detect it.
That’s where your contribution is sought and would be highly appreciated. If you come across malware that isn’t detected with the official ClamAV signatures and you have your own signature to detect it, please provide it to us! It will go through our regular QA cycle and we will provide you with personal feedback. Your signature will be tweaked if necessary and tested against our clean files in order to prevent false positives once released. We will also give you credit for the signature your contributed unless you choose to remain anonymous.
You have a few ways of contributing signatures:
– Go to http://www.clamav.net/lang/en/sendvirus/submit-malware/
In the description field, provide your signature along with supporting evidence. Attach your sample and submit.
– Submit your password protected zip (a typical password is ‘infected’) along with your research and signature via email to vrt[at]sourcefire.com
We prefer “body-based” signatures as opposed to “checksum-based” signatures. Hex (body) signatures are based on a fragment of a malware sample’s body converted into a hexadecimal string which can be extended using various wildcards. More on how to write ClamAV signatures here and here.
Of course we are always accepting false positive submissions here.
]]>
]]>
