[Clamav-users] Totally Confused
Hi, I am attempting to replace our e-mail virus scanner (RAV) with clamav. I am running it under OS X 10.3. I have about 250 e-mail messages that RAV has quarantined as being virus infected. If I use clamscan to scan these files, it only finds a few files that are infected (with I.Frame). If I use McAfee Virex, it finds no infected files. Yet RAV steadfastly insists that most of these files are infected thusly: The infected file was saved to quarantine with name: 1083955063-460226.msg. The file (part0005:postcard.zip)->(Zip) attached to mail (with subject:test) sent by to is infected with virus: Win32/[EMAIL PROTECTED] All of the messages in question seem like bogus e-mails with spoofed addresses. I'm really confused as to whether i can trust clamav or not. I have downloaded the latest definitions with freshclam and run clamd in debug mode to make sure it's using the newly updated databases. Any suggestions? Thanks, Phil Ershler --- This SF.Net email is sponsored by Sleepycat Software Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to deliver higher performing products faster, at low TCO. http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3 ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] bug in clamdscan
It was when I composed this message. I just couldn't get connected to a network until this morning. I was really quite serious. If you want to make a contribution, contact the the Clamav team. Phil On Jun 21, 2004, at 1:35 PM, Dan Egli wrote: Philip Ershler wrote: If you don't like the software, and are unhappy about how much you paid for it, contact the Clamav team and ask for a job. Just my 2 cents. Phil First, it was just a suggestion! Second, Fix your clock! It's not 11 pm Sunday! -- -- Dan --- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- This SF.Net email sponsored by Black Hat Briefings & Training. Attend Black Hat Briefings & Training, Las Vegas July 24-29 - digital self defense, top technical experts, no vendor pitches, unmatched networking opportunities. Visit www.blackhat.com ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Downloading clam virus definition files automatically
Every 10 minutes is much to often. There was a thread about this issue just a while ago. The consensus was 1 to 4 hours and not exactly on the hour. If everybody ran freshclam every 10 minutes, the server would croak. Phil On Aug 19, 2004, at 5:21 PM, Steven Stern wrote: On Fri, 20 Aug 2004 02:15:51 +0530, Rajanikanth P <[EMAIL PROTECTED]> wrote: Hello All, I want to write a script/program which checks for clam virus updates every 10 minutes and updates the respective files. Can anybody provide me some information on sites that host clam av definitions and also tell me which is the most efficient and reliable site Thanks in advance. sudo crontab -e add at the end */10 * * * * /path/to/freshclam --quiet -- Steve --- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] foto From: "Rse" To: "Modssl-users"
On Sep 1, 2004, at 7:44 AM, xterm1 wrote: |-Original Message- |From: [EMAIL PROTECTED] |[mailto:[EMAIL PROTECTED] Behalf Of Maurizio |Marini |Sent: Wednesday, September 01, 2004 8:21 AM |To: [EMAIL PROTECTED] |Subject: [Clamav-users] foto From: "Rse" <[EMAIL PROTECTED]> To: |"Modssl-users" <[EMAIL PROTECTED]> | | |as subscriber to Modssl-users, i'm receiving by yestarday many copies of an |email with subject: foto |coming from engelschall |i think some of them have received it , too | |is this mail infected? |if yes, why clamav doesn't recognize it? |maurizio | | | I recieved the foto Virus, Clamav and f-prot both found it apon scanning Brian I am running clam .0.75.1 on OSX. I had several e-mails that made reference to "foto" get through clam. I am running the old RAV behind clam and Rav caught these messages. Phil --- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Good job ClamAV team!
I would like to second your thoughts on this matter. All to often we users tend to take this software and all the work behind it for granted. The vast majority of posts on this lists are problems with this or that, or why didn't you do it this way or that way. I'd like to just join in and say to all the developers and maintainers: "Thank you very much for all your work on a project that benefits innumerable systems throughout the world. Clamav has truly made a difference! Your efforts to improve the system and take on the nasty job of keeping virus definitions up to date is truly appreciated! Thanks Again, Phil On Nov 16, 2004, at 10:52 AM, Minica, Nelson (EDS) wrote: 1024 viruses blocked in the last month (after 152,000 emails blocked by RBL's,etc)68 were phishing attacks my users appreciated not seeingThen SpamAssassin flagged 1500 and Mimedefang removed 1300 attachments…Overlapping products and multiple lines of defense are a great idea. I'd much rather have overlap than "underlap". :)___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
