ClamWin Free Antivirus :: View topic - Safebrowsing / anti-phishing

Posted: Thu Sep 12, 2019 1:12 pm

I've run the clamav safebrowsing and now I have the safebrowsing.cld file in the database
I submit all kinds of files with suspicious links for review and I get no notification,
When I ran with the --debug flag I saw the following message repeated:
LibClamAV debug: init_tdb: Signature for Phishtank.Phishing.PHISH_ID_5970789-6956916-0 not loaded (required f-level: 83
The file I send looks like this:
<html>
<a> test </a>
</html>

Does anyone have a solution for me? Rolling Eyes

Posted: Thu Sep 12, 2019 1:15 pm

(in the "a" tag I have href with a suspicious link)

Posted: Thu Sep 12, 2019 4:56 pm

Clam AV does not have enough signatures for ClamWin to protect users adequately. There are more than 300,000 individual versions of malware released each day, but Clam AV only prepares about 1,000 daily signatures. Despite this, however, I never use any virus databases other than the official Main and Daily databases that come from Clam AV in order to prevent any problems such as you have.

Instead, I rely upon browser addons to protect me from "bad" web sites and malware ads/popups. As recommended by the ClamWin developers, I also use a real-time AV as my primary AV and keep ClamWin as a backup. Most real-time AVs also have some browser protection.

I suggest that you do the same.

Regards,

Posted: Sun Sep 15, 2019 7:42 am

I want to use it for scanning emails and IMs, not in the browser, so I have to use something like that, plus I want to have the ability to scan the links even without external network, so I need the clamav-safebrowsing solution.
Have you been able to test the clamav-safebrowsing?
Do you have a file that should be alerted so I can test it too?

Posted: Sun Sep 15, 2019 2:50 pm

The ClamWin project depends upon the Clam AV project, which is now owned by Cisco. The ClamWin developers merely prepare a Windows port from the Clam AV code intended for Linux email servers. This primarily entails adding a GUI, although they may make some changes to accommodate use on Windows. Clam AV is responsible for all virus detection and signatures.

You might check with Sane Security regarding any signatures they provide to Clam AV.

Regards,