Hi all,
Is that possible to know the location of installed files and scan resualt log
files?
best,
Frank
----------------------------------------
> From: [EMAIL PROTECTED]
> Subject: clamav-users Digest, Vol 24, Issue 21
> To: clamav-users@lists.clamav.net
> Date: Thu, 28 Sep 2006 12:00:03 +0200
>
> Send clamav-users mailing list submissions to
> clamav-users@lists.clamav.net
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> or, via email, send a message with subject or body 'help' to
> [EMAIL PROTECTED]
>
> You can reach the person managing the list at
> [EMAIL PROTECTED]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of clamav-users digest..."
>
>
> Today's Topics:
>
> 1. LibclamAV - Very Slow (Alexander Hagenah)
> 2. Re: LibclamAV - Very Slow (Webmaster)
> 3. Re: LibclamAV - Very Slow (Paul Bijnens)
> 4. Re: LibclamAV - Very Slow (tBB)
> 5. RE: LibclamAV - Very Slow (Alexander Hagenah)
> 6. Re: LibclamAV - Very Slow (tBB)
> 7. how to uninstall ClamAV from FreeBSD server? (ZhangFrank)
> 8. Re: how to uninstall ClamAV from FreeBSD server? (Dennis Peterson)
> 9. Re: Clamstats (John Fleming)
> 10. Re: Clamstats (Dennis Peterson)
> 11. Re: how to uninstall ClamAV from FreeBSD server? (Jay West)
> 12. clamav can't check rar file (Ardi)
> 13. Re: clamav can't check rar file (Trog)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 27 Sep 2006 14:27:52 +0200
> From: "Alexander Hagenah" <[EMAIL PROTECTED]>
> Subject: [Clamav-users] LibclamAV - Very Slow
> To: <clamav-users@lists.clamav.net>
> Message-ID:
> <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Howdy,
>
> I'm using my XMail [1] and have 2 virus-scanner implemented into an own
> tool, which is working between MTA and the virus-scanners.
> There, I am using BitDefender API and ClamAV [libclamav].
>
> My application is called every time, a mail arrives.
>
> But they are as different speedy, I never expected.
>
> With LibClamAV-function activated:
>
> .--
> | [EMAIL PROTECTED] filter]$ time ./main test_mail
> |
> | real 0m3.896s
> | user 0m1.488s
> | sys 0m0.135s
> `--
>
> With BitDefender-function activated:
>
> .--
> | [EMAIL PROTECTED] filter]# time ./main test_mail
> |
> | real 0m0.012s
> | user 0m0.004s
> | sys 0m0.004s
> `--
>
> Extremly difference, eh?
> The virus is discovered by both, so everything is working fine with
> LibClamAV I think?!
>
> I attach the function. Maybe some of you guys can help me with that
> problem.
> I cannot expect at all, that LibClamAV is so slow in any case.
>
> [1] http://xmailserver.org
>
> --
>
> With kind regards,
> Alexander Hagenah
> -------------- next part --------------
> int vCheckClamAv() {
>
> int ret;
> unsigned int sigs = 0;
> unsigned long int blocks = 0;
> struct cl_node *root = NULL;
> struct cl_limits limits;
> struct cl_stat dbstat;
>
> memset(&dbstat, 0, sizeof(struct cl_stat));
> cl_statinidir(cl_retdbdir(), &dbstat);
>
> if((cl_loaddbdir(cl_retdbdir(), &root, &sigs))) {
> errorHandler(ERRCODE_SMTP_TEMP, ERRSTR_INTERN_CLAMDB);
> }
>
> if((ret = cl_build(root))) {
> syslog(LOG_NOTICE, "Database initialization error: %s\n",
> cl_strerror(ret));
> cl_free(root);
> close(clam_fd);
> }
>
> clam_fd = open(mailFileName, O_RDONLY);
>
> memset(&limits, 0, sizeof(struct cl_limits));
>
> limits.maxfiles = 1000;
> limits.maxfilesize = 10 * 1048576;
> limits.maxreclevel = 5;
> limits.maxratio = 200;
> limits.archivememlim = 0;
>
> if((!cl_scandesc(clam_fd, &clamav_virname, &blocks, root, &limits,
> CL_SCAN_STDOPT)) == CL_VIRUS) {
> syslogCav();
> vStatus = 1;
> }
>
> virName = (char*) clamav_virname;
> syslog(LOG_NOTICE, "virus: %s", virName);
>
> return(vStatus);
> }
>
> ------------------------------
>
> Message: 2
> Date: Wed, 27 Sep 2006 15:11:39 +0200
> From: Webmaster <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] LibclamAV - Very Slow
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi,
>
> Le Mercredi 27 Septembre 2006 14:27, Alexander Hagenah a écrit :
>
> > My application is called every time, a mail arrives.
> ...And every time you load the signature databases, I guess...
>
> Cordialement,
>
> Arnaud Jacques
> Consultant Sécurité
>
> Téléphone / Fax : +33-(0)3.44.39.76.46
> Portable : +33-(0)6.24.40.95.03
> E-mail : [EMAIL PROTECTED]
>
> Securiteinfo.com
> La Sécurité Informatique - La Sécurité des Informations.
> 266, rue de Villers
> 60123 Bonneuil en Valois
> _______________________________
>
>
> ------------------------------
>
> Message: 3
> Date: Wed, 27 Sep 2006 15:07:38 +0200
> From: Paul Bijnens <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] LibclamAV - Very Slow
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> On 2006-09-27 14:27, Alexander Hagenah wrote:
> > But they are as different speedy, I never expected.
>
> You're loading and unpacking the virus database each time.
> You see the same difference between "clamscan" and "clamdscan".
>
>
> --
> Paul Bijnens, xplanation Technology Services Tel +32 16 397.511
> Technologielaan 21 bus 2, B-3001 Leuven, BELGIUM Fax +32 16 397.512
> http://www.xplanation.com/ email: [EMAIL PROTECTED]
> ***********************************************************************
> * I think I've got the hang of it now: exit, ^D, ^C, ^\, ^Z, ^Q, ^^, *
> * F6, quit, ZZ, :q, :q!, M-Z, ^X^C, logoff, logout, close, bye, /bye, *
> * stop, end, F3, ~., ^]c, +++ ATH, disconnect, halt, abort, hangup, *
> * PF4, F20, ^X^X, :D::D, KJOB, F14-f-e, F8-e, kill -1 $$, shutdown, *
> * init 0, kill -9 1, Alt-F4, Ctrl-Alt-Del, AltGr-NumLock, Stop-A, ... *
> * ... "Are you sure?" ... YES ... Phew ... I'm out *
> ***********************************************************************
>
>
>
> ------------------------------
>
> Message: 4
> Date: Wed, 27 Sep 2006 15:31:42 +0200
> From: tBB <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] LibclamAV - Very Slow
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=ISO-8859-1
>
> >>>My application is called every time, a mail arrives.
> >>
> >> ...And every time you load the signature databases, I guess...
>
> > What he probably means is that you should use ClamD/ClamDScan instead of
> > ClamScan.
>
> Sorry, I brain-farted. What I probably meant is that you should use
> ClamD if possible and connect directly to it instead of using libclamav.
>
> Best regards, Nico
>
> --
> +------------------------------------------------------------------+
>
> Q: Because it reverses the logical flow of conversation.
> A: Why is putting a reply at the top of the message frowned upon?
>
>
>
> ------------------------------
>
> Message: 5
> Date: Wed, 27 Sep 2006 15:35:45 +0200
> From: "Alexander Hagenah" <[EMAIL PROTECTED]>
> Subject: RE: [Clamav-users] LibclamAV - Very Slow
> To: "ClamAV users ML" <clamav-users@lists.clamav.net>
> Message-ID:
> <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="iso-8859-1"
>
> [EMAIL PROTECTED] <> schrieb am :
>
> > On 2006-09-27 14:27, Alexander Hagenah wrote:
> >> But they are as different speedy, I never expected.
> >
> > You're loading and unpacking the virus database each time.
> > You see the same difference between "clamscan" and "clamdscan".
>
> I see and found the fault in my code.
> But, can't I change it like I the signatures/database is loaded once
> into memory and after, I just call this instead?
>
> --
>
> Mit freundlichem Gruss
>
> Alexander Hagenah
> Technik
>
> top concepts Internetmarketing GmbH
> Am Steinkamp 7 - D-21684 Stade - Germany
>
> ------------------------------------------------------------
> Damit wir Ihnen bestmöglichen Service bieten können, senden
> Sie Ihre E-Mail-Anfragen bitte an [EMAIL PROTECTED]
> ------------------------------------------------------------
>
> http://www.topconcepts.de Tel. +49 1805 9977 501*
> E-Mail: [EMAIL PROTECTED] Fax. +49 1805 9977 502*
> ------------------------------------------------------------
> Handelsregister: AG Tostedt HRB 100687 - UstId: DE 213645563
> ------------------------------------------------------------
> *) EUR 0,12/Min. (CNS24)
> ------------------------------------------------------------
>
>
> ------------------------------
>
> Message: 6
> Date: Wed, 27 Sep 2006 15:20:52 +0200
> From: tBB <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] LibclamAV - Very Slow
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=ISO-8859-1
>
> >>My application is called every time, a mail arrives.
> >
> > ...And every time you load the signature databases, I guess...
>
> What he probably means is that you should use ClamD/ClamDScan instead of
> ClamScan.
>
> Best regards
>
> Nico
>
> --
> +------------------------------------------------------------------+
>
> Q: Because it reverses the logical flow of conversation.
> A: Why is putting a reply at the top of the message frowned upon?
>
>
> ------------------------------
>
> Message: 7
> Date: Thu, 28 Sep 2006 11:22:20 +0800
> From: "ZhangFrank" <[EMAIL PROTECTED]>
> Subject: [Clamav-users] how to uninstall ClamAV from FreeBSD server?
> To: clamav-users@lists.clamav.net
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="gb2312"
>
> hi all,
>
> how to uninstall ClamAV from FreeBSD server?
>
>
> best,
>
>
> Frank
> _________________________________________________________________
> ÂÊÏȳ¢ÊÔ Windows Live Mail¡£
> http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-4911fb2b2e6d
>
>
> ------------------------------
>
> Message: 8
> Date: Wed, 27 Sep 2006 21:08:27 -0700
> From: Dennis Peterson <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] how to uninstall ClamAV from FreeBSD
> server?
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=GB2312
>
> ZhangFrank wrote:
> > hi all,
> >
> > how to uninstall ClamAV from FreeBSD server?
> >
> >
> > best,
> >
> >
>
> If you installed it from a package then use your package manager tools to
> uninstall it. If you built it from source then try
>
> # make uninstall
>
> dp
>
>
> ------------------------------
>
> Message: 9
> Date: Wed, 27 Sep 2006 21:38:55 -0400
> From: "John Fleming" <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] Clamstats
> To: "ClamAV users ML" <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; format=flowed; charset="utf-8";
> reply-type=original
>
> Mine doesn't like using `localhost` or `mydomain.com` or `nn.nnn.nnn.nn` (my
> IP)
>
> What is wrong here?? Thanks! - John
>
> my $logfile = "/var/log/clamav/clamav.log";
> my $fclogfile = "/var/log/clamav/freshclam.log";
> my $host = `localhost`;
>
> ----- Original Message -----
> From: "Chris" <[EMAIL PROTECTED]>
> To: "ClamAV users ML" <clamav-users@lists.clamav.net>
> Sent: Tuesday, September 26, 2006 7:18 AM
> Subject: Re: [Clamav-users] Clamstats
>
>
> > _______________________________________________
> > http://lurker.clamav.net/list/clamav-users.html
> >
>
>
>
> ------------------------------
>
> Message: 10
> Date: Wed, 27 Sep 2006 21:24:34 -0700
> From: Dennis Peterson <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] Clamstats
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> John Fleming wrote:
> > Mine doesn't like using `localhost` or `mydomain.com` or `nn.nnn.nnn.nn`
> > (my IP)
> >
> > What is wrong here?? Thanks! - John
> >
> > my $logfile = "/var/log/clamav/clamav.log";
> > my $fclogfile = "/var/log/clamav/freshclam.log";
> > my $host = `localhost`;
>
> The backticks are not quotes. Their presence causes perl to try to
> execute an external executable which in your case is localhost and that
> probably does not exist as an executable, and if it did the chances of
> it returning your system hostname approach the null set.
>
> Use `hostname` which is an executable that returns as a string the
> hostname of your system (may require full path, i.e.
> `/usr/bin/hostname`, or 'localhost' which is a string inside single
> quotes. You can also use double quotes as in "localhost"
>
> dp
>
>
> ------------------------------
>
> Message: 11
> Date: Wed, 27 Sep 2006 23:01:37 -0500
> From: "Jay West" <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] how to uninstall ClamAV from FreeBSD
> server?
> To: "ClamAV users ML" <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; format=flowed; charset="gb2312";
> reply-type=original
>
> Frank wrote....
> > how to uninstall ClamAV from FreeBSD server?
>
> Assuming you installed from the ports collection, use:
>
> pkg_delete -ix clamav
>
> Answer Y or N as appropriate.
>
> Jay West
>
>
> ------------------------------
>
> Message: 12
> Date: Thu, 28 Sep 2006 16:40:23 +0800
> From: Ardi <[EMAIL PROTECTED]>
> Subject: [Clamav-users] clamav can't check rar file
> To: Clamav-users <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=GB2312
>
> Hi:
>
> I compress eicar.com.txt sample virus with WinRAR 3.50, then check the
> rar file. ClamAv can not check the virus.
> Does ClamAV support scan rar file?
>
> Thanks for any help!
> Ardi
>
>
> ------------------------------
>
> Message: 13
> Date: Thu, 28 Sep 2006 10:23:56 +0100
> From: Trog <[EMAIL PROTECTED]>
> Subject: Re: [Clamav-users] clamav can't check rar file
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset="us-ascii"
>
> On Thu, 2006-09-28 at 16:40 +0800, Ardi wrote:
> > Hi:
> >
> > I compress eicar.com.txt sample virus with WinRAR 3.50, then check the
> > rar file. ClamAv can not check the virus.
> > Does ClamAV support scan rar file?
> >
>
> Current CVS version support v3 RAR.
>
> -trog
>
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: not available
> Type: application/pgp-signature
> Size: 189 bytes
> Desc: This is a digitally signed message part
> Url :
> http://lists.clamav.net/pipermail/clamav-users/attachments/20060928/f92ebdf6/attachment.pgp
>
> ------------------------------
>
> _______________________________________________
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> End of clamav-users Digest, Vol 24, Issue 21
> ********************************************
_________________________________________________________________
率先尝试 Windows Live Mail。
http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-4911fb2b2e6d_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
