[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-users
Subject:    Re: [Clamav-users] PUAs
From:       Sarocet <sarocet () gmail ! com>
Date:       2008-09-15 23:30:00
Message-ID: 48CEEFF8.3030809 () gmail ! com
[Download RAW message or body]

Tilman Schmidt wrote:
>>> Sub-Type: IRC
>>> Description: IRC server based programs/malware
> I don't use IRC myself, but respectable people keep telling me
> that it's not for bad guys only, there are legitimate uses for
> it, and I should try it myself to see. So I am a bit reluctant
> to declare all IRC server based programs "possibly unwanted".
By IRC Server based programs do you mean IRC servers or IRC clients?
I thought it referred to the later, but the phrase is strange.
You wouldn't want to forbid mIRC just as you wouldn't want to match
MSN Messenger or Yahoo! Messenger. Unless you have a "no chat" policy,
it's a perfectly legit program and banning may trouble many users. *But*
many botnets use the mIRC program, having its code just as a mIRC script.
If the user knows that it has that program, it's ok. No so much if it 
has been
subrepticiously installed by a worm. I'd recommend to download from
http://mirc.co.uk/ instead of sending by email, though.

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
[prev in list] [next in list] [prev in thread] [next in thread]