Editing ClamAV (section)

== Unofficial databases ==
The ClamAV engine can be reliably used to detect several kinds of malicious files.  In particular, some [[phishing]] emails can be detected using antivirus techniques.  However, false positive rates are inherently higher than those of traditional malware detection.<ref>{{cite web |url=https://uab.edu/cas/thecenter/images/Documents/High-Performance-Content-Based-Phishing-Attack-Detection.pdf |title=High-Performance Content-Based Phishing Attack Detection |author1=Brad Wardman |author2=Tommy Stallings |author3=Gary Warner |author4=Anthony Skjellum |date=5 August 2011 |website=uab.edu |access-date=19 March 2018}}</ref>

There are several unofficial databases for ClamAV:

* Sanesecurity is an organization that maintains a number of such databases; in addition, they distribute and classify a number of similar databases from other parties, such as Porcupine, Julian Field, MalwarePatrol.<ref name="sanesecurity">Sanesecurity [http://www.sanesecurity.com/clamav/databases.htm Phishing, Scam and Malware signatures for ClamAV] {{Webarchive|url=https://web.archive.org/web/20150910185428/http://www.sanesecurity.com/clamav/databases.htm |date=2015-09-10 }}</ref> 
* SecuriteInfo.com also provides additional signatures for ClamAV.<ref name="securiteinfo">SecuriteInfo.com [https://www.securiteinfo.com/services/improve-detection-rate-of-zero-day-malwares-for-clamav.shtml Add 4.000.000 signatures to ClamAV Antivirus]</ref>

ClamAV Unofficial Signatures are mainly used by system administrators to filter email messages.<ref>{{cite web |url=http://sourceforge.net/projects/unofficial-sigs/ |title=ClamAV Unofficial Signatures Updater |author=<!--Staff writer(s); no by-line.--> |date=24 May 2009 |website=sourceforge.net |access-date=2 September 2014}}</ref>  Detections of these groups should be scored, rather than causing an outright block of the "infected" message.<ref name="sanesecurity"/>