extremeshok / clamav-unofficial-sigs

ClamAV Unofficial Signatures Updater maintained by eXtremeSHOK.com
https://eXtremeSHOK.com
Other
513 stars 116 forks source link

Securite info not downloading all databases #407

Open kprkpr opened 2 years ago

kprkpr commented 2 years ago

Hi! I'm having problems with securiteinfo (With premium) download of databases.. image

And in /var/lib/.../dbs-si, doesn't appear anything more than the two files below: image

I upload the master and user conf files I don't know why doesn't download it... config-files.zip

(In config files I found that uploaded with 0 hours wait to download databases, it was a test to force download, but with 1 hour the result is same)

stevenhardey commented 2 years ago

Not sure what the issue is per se, but if you remove /var/lib/clamav-unofficial-sigs/configs/last-si-update.txt you should be able to run the command again.

ediazrod commented 2 years ago

Don't work...

The list of si include ..

securiteinfo.hdb securiteinfo.ign2 javascript.ndb spam_marketing.ndb securiteinfohtml.hdb securiteinfoascii.hdb securiteinfoandroid.hdb securiteinfopdf.hdb securiteinfo0hour.hdb securiteinfo.mdb securiteinfo.yara securiteinfo.pdb

This limits a lot the ratio of detection...

Nitrocad commented 2 years ago

This error is simple: edit the master.conf and extend the declaration of the premium dbs at line 315 on dev version with the following:

securiteinfo.ign2|REQUIRED # Signature Whitelist securiteinfo.hdb|LOW # Malwares younger than 3 years. javascript.ndb|LOW # Malwares Javascript spam_marketing.ndb|HIGH # Spam Marketing / spammer blacklist securiteinfohtml.hdb|LOW # Malwares HTML securiteinfoascii.hdb|LOW # Text file malwares (Perl or shell scripts, bat files, exploits, ...) securiteinfoandroid.hdb|LOW # Malwares Java/Android Dalvik securiteinfoold.hdb|LOW # Malwares older than 3 years. securiteinfopdf.hdb|LOW # Malwares PDF

melias3 commented 2 years ago

The securiteinfo_premium_dbs is squashing securiteinfo_dbs var

line 2442 (from master branch) if [ -n "$temp_db" ] ; then read -r -a securiteinfo_dbs <<< "$temp_db" fi

I locally substituted read by:

read -r -a securiteinfo_dbs <<< "$temp_db ${securiteinfo_dbs[@]}"

and worked