0

I see ClamAV telling me the names of all the viruses that it has detected on my computer, but it seems to give me very little documentation on what those detections actually mean, and what the viruses actually are. It doesn't even tell me the structure of the detection name so I can't even judge for myself what each part could mean. This is the only documentation that I could find: https://github.com/vrtadmin/clamav-devel/raw/master/docs/signatures.pdf And this does not even give me the detection definitions for half of them. Is there any more documentation that explains what the virus detection definitions mean, and how they are structured with the dots and everything? And if there is no more documentation currently then is there any planned? How do people write the definitions if there is no more documentation out there? There must be but it is just not publicly available. But this is bad because why bother with taking the time to make fancy detection names if no one other than them know what they mean?

More detailed documentation is greatly needed, for it can detect a virus, and give the the name of the detection, but you have no idea anything about that detection and you can't even look it up to know if it wanted to reformat your hard drive or if it was spying on your every move.

  • You found viri? On Ubuntu? Or are we talking about a Windows system? And if the latter: why would we need to provide descriptions for a system we do not support? Should you not ask this someone from ClamAV (=3rd party software)? – Rinzwind Jan 8 '15 at 13:55
  • I found several viruses on my Ubuntu. But have no idea what they are because there is no explanation of what the detection definitions mean. – user364819 Jan 8 '15 at 13:59
  • I have tried to find a way to contact ClamAV but have not yet found a way. – user364819 Jan 8 '15 at 14:01
  • Please add in images of the messages/files from clamav. At the present time there are a total of zero viri active for Ubuntu. edit: add in the URL. someone will make it into images. – Rinzwind Jan 8 '15 at 14:01
  • I deleted the viruses and this don't have the names of the definitions at the moment or a screenshot of them. But is does say here that there are many Linux viruses out there: help.ubuntu.com/community/Linuxvirus So I am sure that some could affect Ubuntu. – user364819 Jan 8 '15 at 14:09
2
+50

Use the command:

sigtool --find-sigs <virus name> | awk ‘{ print $2 }’ | sigtool --decode-sigs

This will find the signature pull the signature part from the output and the turn it into “plain language”. The exception are hashes which just indicate the whole is known bad.

Then you can look for that plain language in the files in question and determine if it’s accurate or a false positive.


Update: The use of sigtool in this fashion (--find-sigs and --decode-sigs) is not covered explicitly in the signature creation documentation (signatures.pdf). The documentation covers everything else needed to create your own signatures, including the accepted naming conventions and a description of what they imply (section 3.10 Signature names ... ClamAV uses the following prefixes for signature names ...)

Beyond that, it is an exercise for the end-user to determine if something detected is actually malicious or if it's a false positive, and the way to do that is to understand what the signature is looking for and where it is in the impacted file. As I mentioned, the only thing that doesn't work with is hashes. The best you can do for those is look up the hash in various online scanners and get a sense for what other engines are detecting them as and looking up the virus names as well.

If these two things (the existing documentation and the use of sigtool), do not answer the question then the question needs to be rephrased so it is clearer as to the intent of the question. The 'why' someone thought something is malicious should be clear from the decoded virus signature. If it's not, or if you disagree with the detection, it should be reported as a false positive so the signature can be improved / clarified / etc.

Looking at Win.Exploit.Unicode_Mixed-1 as an example, I would say that it's not a great sig for exactly this reason (it's not immediately clear what about that sequence is malicious).

It's unclear (to me) what about that sequence is malicious though it's probably something that is common to mixed unicode script exploitation (but again, that's a guess). From the name of the virus, the expectation would be that you would find it on Windows systems or on something that Windows systems can access and there's likely an exploit related to mixing unicode characters and non-unicode characters that matches that signature. With that information you can simply do a quick Google search for "Windows mixed unicode exploit" which will bring up 133,000+ results of sites talking about building exploits to take advantage of Unicode processing issues in Windows.

If you're seeing that in tcpdump output on your IDS, then it's likely a case of either one of your systems pulling that data from an exploited remote system (like a web server).

The OP was asking if there are "plans to regulate the signature names so that they are more regular and people actually know what they mean"...and that IS in the signature writing documentation. Or, at least, the guidelines are presented there which the ClamAV folks try to follow and recommend to others. If you are pulling from other third-party sources, they probably have their own naming conventions.

The OP is correct that the list of names in the documentation is woefully incomplete even for the signatures that ClamAV writes. But seeing as ClamAV is open-source and pretty much anyone can write signatures for it without approval from the ClamAV authors, there is zero chance of "regulation" of signature names.

The best you can do is break down the name, look at the signature definition, and Google. And sigtool will, at the very least, tell you what ClamAV is seeing as malicious even if it doesn't tell you why the signature author thought it was malicious to begin with.

  • Welcome Maarten to askubuntu! Please format your post regarding askubuntu guidleines. E.g. put 4 spaces in a new line before a command to get the right format. – abu_bua Jun 28 '18 at 13:01
  • But is there any explanation for why the person who wrote the signature actually thought it was malicious and chose that exact name for it? – user364819 Jun 28 '18 at 19:51
  • If not, then please just update your answer with that and I will "accept" it – user364819 Jun 28 '18 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy