Re: [Clamav-users] Clamav-milter and Logwatch

2003-10-22 Thread Søren Schimkat
Soren Schimkat wrote: Hi Guys If you want Logwatch to display clamav-milter logs - you can use the following files (a short description is located below the files): [snip] I've just created a new set of files - which also matches the latest CVS version of Clamav / Clamav-milter: http://www.

[Clamav-users] Compilation Issues - Automake version mismatch

2003-10-22 Thread Dennis Skinner
Just an FYI RedHat 9 box, got this error during make: *** # make cd . && \ /bin/sh /export/clamav/build/clamav-devel-20031021/missing --run automake-1.6 --gnu Makefile aclocal.m4:4200: version mismatch. This is Automake 1.6.3, but aclocal.m4 aclocal.m4:4200: was generated for Automake

Re: [Clamav-users] Re: ERROR: Can't open file

2003-10-22 Thread Gerardo Reynoso Cobos
Chris de Vidal wrote: No, I'm still getting this error. Could someone in the group shed light on this problem? Suggestions? Ideas? /dev/idal --- Mike Parin <[EMAIL PROTECTED]> wrote: Hi Chris, I'm experiencing exactly the same problem with clamav as you expressed on the mailing list (see bel

Re: [Clamav-users] 'Orphaned' clamav-milter child processes

2003-10-22 Thread Tomasz Kojm
> There was above 500 clamav-milter processes (they ate 1GB my server's > memory !) > > I must run amavis or mailscanner :(( What about clamd itself ? Is it stable ? Best regards, Tomasz Kojm -- oo. [EMAIL PROTECTED] (\/)\. http://www.konarski.edu.

[Clamav-users] RE: viruses that forge from: and/or envelope sende r addresses

2003-10-22 Thread Jesse Guardiani
McDonald, Dan wrote: > -Original Message- > From: Jesse Guardiani >>Is there a database anywhere that lists all the viruses >>that forge addresses? > > There may be, but can you react quickly to a new one? If one exists, then yes, I can. I'm a programmer. I could easily automate the cre

RE: [Clamav-users] viruses that forge from: and/or envelope sender addresses

2003-10-22 Thread Diego d'Ambra
> -Original Message- > From: [EMAIL PROTECTED] [mailto:clamav-users- > [EMAIL PROTECTED] On Behalf Of Jesse Guardiani > Sent: 22. oktober 2003 15:43 > To: [EMAIL PROTECTED] > Subject: [Clamav-users] viruses that forge from: and/or envelope sender > addresses > > Howdy list, > > Is there a

Re: [Clamav-users] viruses that forge from: and/or envelope sender addresses

2003-10-22 Thread Tomasz Papszun
On Wed, 22 Oct 2003 at 9:42:34 -0400, Jesse Guardiani wrote: > > Is there a database anywhere that lists all the viruses > that forge addresses? > > I'd like to prevent my server from sending out false > notification messages. > Not all, just the most frequently met: $viruses_that_fake_sender

Re: [Clamav-users] viruses that forge from: and/or envelope sender addresses

2003-10-22 Thread Stewart MacLund
Generally un-neccesary. Just check if the sending SMTP host matches the from address for the domain. IN general practice, it would be a bad idea to bounce messages back to a non-matching address. Sundie... Jesse Guardiani said: > Howdy list, > > Is there a database anywhere that lists all the

RE: [Clamav-users] false positives

2003-10-22 Thread Diego d'Ambra
Please submit any "false positive" samples to the DB team. You can submit through http://clamav.sourceforge.net/cgi-bin/sendvirus.cgi. We do take these reports very serious, but we need to discover them before any action can be taken. A workaround could be to delete signatures from the DB files y

Re: [Clamav-users] False positive for Cake.A virus?

2003-10-22 Thread Tomasz Papszun
On Tue, 21 Oct 2003 at 22:47:15 -0400, Forrest Aldrich wrote: > I have a file that was detected to have the Cake.A virus; however, my other > scanners (Norton, Ravav, F-Prot, Nod32) do not concur. > > Anyone see this type of false positive. > > Forrest Please, submit a file causing a false posi

RE: [Clamav-users] viruses that forge from: and/or envelope sende r addresses

2003-10-22 Thread McDonald, Dan
-Original Message- From: Jesse Guardiani >Is there a database anywhere that lists all the viruses >that forge addresses? There may be, but can you react quickly to a new one? >I'd like to prevent my server from sending out false >notification messages. I've come to the conclusion that i

Re: [Clamav-users] 'Orphaned' clamav-milter child processes

2003-10-22 Thread Nigel Horne
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 22 Oct 2003 10:42 am, Mike Brodbelt wrote: > Same thing happens to me regularly (every 48-72 hours). When it happens, is clamd still running? Do you see any error messages from it? Do you have ScanArchive enabled? - -Nigel - -- Nigel

Re: [Clamav-users] false positives

2003-10-22 Thread Tomasz Papszun
On Wed, 22 Oct 2003 at 3:52:04 -0400, lists wrote: > i' ve recently started using clamav to scan SAMBA directories, and to > scan incoming e-mail messages (in conjunction with amavis). > > i've been seeing a lot of false positives on the file scans, most of > them Word macro virii: > > WM.CAP

[Clamav-users] viruses that forge from: and/or envelope sender addresses

2003-10-22 Thread Jesse Guardiani
Howdy list, Is there a database anywhere that lists all the viruses that forge addresses? I'd like to prevent my server from sending out false notification messages. Thanks. -- Jesse Guardiani, Systems Administrator WingNET Internet Services, P.O. Box 2605 // Cleveland, TN 37320-2605 423-559-L

[Clamav-users] false positives

2003-10-22 Thread lists
i' ve recently started using clamav to scan SAMBA directories, and to scan incoming e-mail messages (in conjunction with amavis). i've been seeing a lot of false positives on the file scans, most of them Word macro virii: WM.CAP WordMacro.Concept W97M/Story.A Trojan.Stealth.D my script send

[Clamav-users] Re: ERROR: Can't open file

2003-10-22 Thread Chris de Vidal
No, I'm still getting this error. Could someone in the group shed light on this problem? Suggestions? Ideas? /dev/idal --- Mike Parin <[EMAIL PROTECTED]> wrote: > Hi Chris, > > I'm experiencing exactly the same problem with clamav > as you expressed on the mailing list (see below). > Did you

Re: [Clamav-users] 'Orphaned' clamav-milter child processes

2003-10-22 Thread Maciej Kedzierski
> > I've not seen this for a long time. Please post your complete sendmail.mc and > clamav.conf > > - -Nigel > Hello again. My complete clamav.conf and sendmail.mc is at the end. I have another problem (probably continuation my earlier problem) This morning clamav-milter has died completely

[Clamav-users] False positive for Cake.A virus?

2003-10-22 Thread Forrest Aldrich
I have a file that was detected to have the Cake.A virus; however, my other scanners (Norton, Ravav, F-Prot, Nod32) do not concur. Anyone see this type of false positive. Forrest --- This SF.net email is sponsored by OSDN developer relatio

Re: [Clamav-users] 'Orphaned' clamav-milter child processes

2003-10-22 Thread Mike Brodbelt
Nigel Horne wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > I've not seen this for a long time. Please post your complete sendmail.mc and > clamav.conf Same thing happens to me regularly (every 48-72 hours). Using CVS snapshot from 20030926. I was hoping that it was fixed in current

Re: [Clamav-users] 'Orphaned' clamav-milter child processes

2003-10-22 Thread Nigel Horne
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I've not seen this for a long time. Please post your complete sendmail.mc and clamav.conf - -Nigel - -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk -BEGIN PGP S

[Clamav-users] News from the Horne household

2003-10-22 Thread Nigel Horne
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am about to go abroad on business until the end of November. Although I will remain in e-mail contact, response times will be longer than usual. If it takes me sometime to get back to questions or support you please be patient! - -Nigel - -- Nige