Re: [Clamav-users] mod_clamav problem compiling

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 15:08:21 +0100 Vladimir Orlando <[EMAIL PROTECTED]> wrote: > Hi, i'm new. > My name's Vlad. > I'm writing to you because i've a problem compiling mod_clamav. Hello Vlad, > checking dynamic linker characteristics... GNU/Linux ld.so > checking for cl_scanfile in -lclamav... no

Re: [Clamav-users] Disabling Filename blocks / Images coming up as Viruses

2004-01-15 Thread Tomasz Papszun
On Thu, 15 Jan 2004 at 19:37:33 -0500, Rick Macdougall wrote: > Devin Atencio wrote: > > >I am currently using ClamAV 0.65 and I have noticed that several people > >Who have been trying to send random files through the server get blocked. > >Is there an option I can specify in the clamav.conf so t

Re: [Clamav-users] Disabling Filename blocks / Images coming up as Viruses

2004-01-15 Thread Rick Macdougall
Hi, Devin Atencio wrote: I am currently using ClamAV 0.65 and I have noticed that several people Who have been trying to send random files through the server get blocked. Is there an option I can specify in the clamav.conf so that it doesn't block Files in any way of being sent to the user especi

[Clamav-users] Disabling Filename blocks / Images coming up as Viruses

2004-01-15 Thread Devin Atencio
I am currently using ClamAV 0.65 and I have noticed that several people Who have been trying to send random files through the server get blocked. Is there an option I can specify in the clamav.conf so that it doesn't block Files in any way of being sent to the user especially files like .jpg, or .

[Clamav-users] unsubscribe hackpch

2004-01-15 Thread pacho baratta
Title: unsubscribe hackpch

Re: [Clamav-users] a question of size

2004-01-15 Thread Stewart MacLund
Robin Lynn Frank said: > Well, there goes that idea. The reason I asked is that if we have to > take the server down for any reason, there can be a lot of mail from > our backup that has to be processed when we are back up. We have a > script that invokes clamscan to scan mail as it arrives an

Re: [Clamav-users] a question of size

2004-01-15 Thread Stewart MacLund
Robin Lynn Frank said: > Well, there goes that idea. The reason I asked is that if we have to > take the server down for any reason, there can be a lot of mail from > our backup that has to be processed when we are back up. We have a > script that invokes clamscan to scan mail as it arrives an

Re: [Clamav-users] a question of size

2004-01-15 Thread Tomasz Papszun
On Thu, 15 Jan 2004 at 10:55:41 -0800, Robin Lynn Frank wrote: > On Thursday 15 January 2004 09:33, Tomasz Papszun wrote: > > On Thu, 15 Jan 2004 at 9:08:11 -0800, Robin Lynn Frank wrote: > > > No this is not spam. My question is does anyone know the smallest size > > > for virus/trojan/worm pay

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 16:45:20 + (GMT) Trog <[EMAIL PROTECTED]> wrote: > Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > > > > > > > Your patch is incorrect. It will always be true for threads that > > > are currently in use and they will instantly be killed. > > > > I disagree. The patch does the

Re: [Clamav-users] a question of size

2004-01-15 Thread Tomasz Papszun
On Thu, 15 Jan 2004 at 9:08:11 -0800, Robin Lynn Frank wrote: > No this is not spam. My question is does anyone know the smallest size for > virus/trojan/worm payload around? We scan incoming mail and I am looking for > a way to reduce resource useage by setting a lower limit on what is scanne

RE: [Clamav-users] a question of size

2004-01-15 Thread Jason Balicki
>No this is not spam. My question is does anyone know the >smallest size for >virus/trojan/worm payload around? We scan incoming mail and I >am looking for >a way to reduce resource useage by setting a lower limit on >what is scanned.. That might be a bad idea. Consider the case of someone

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread EyedMax
Nigel Horne wrote: FREE-BSD 4.4-RELEASE I only have 4.7 and 4.8 (4.4 is rather old now) so I can't be 100% sure this will work for you. I suggest downloading the latest sendmail source from sendmail.org, cd to libmilter and doing 'make install' there. Report back here how it goes, it isn't as daun

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > > > > Your patch is incorrect. It will always be true for threads that are > > currently in use and they will instantly be killed. > > I disagree. The patch does the same thing that yours. > You patched a different line of code, so the argument is moo

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 14:37:56 + (GMT) Trog <[EMAIL PROTECTED]> wrote: > Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > > > > Oh, you're right - there was no chance to disable the timeout > > (however clamav.conf states that 0 disables the limit). It's even > > better to use: > > > > if(timeout &

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread EyedMax
Ing. Germa'n Gonza'lez B. wrote: This is my old logs. Have you installed the milter SDK yet? As I said, the milter won't build without that. -Nigel You dont't have installed sendmail with milter support. Your log shows checking whether setpgrp takes no argument... no checking libmilter/mfapi.h u

RE: [Clamav-users] clamd backtrace

2004-01-15 Thread Trog
Quoting Philipp Grosswiler <[EMAIL PROTECTED]>: > > LinuxThreads are based on processes - the three processes > > are: the main thread of clamd, threadwatcher (from clamd) and > > thread-manager (always spawned by LinuxThreads). > > So it is correct to only use gdb with the first process (main

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread Ing. Germán González B.
> > > This is my old logs. > > Have you installed the milter SDK yet? As I said, the milter won't build without > that. > > -Nigel > > You dont't have installed sendmail with milter support. Your log shows checking whether setpgrp takes no argument... no checking libmilter/mfapi.h usability

RE: [Clamav-users] clamd backtrace

2004-01-15 Thread Philipp Grosswiler
> LinuxThreads are based on processes - the three processes > are: the main thread of clamd, threadwatcher (from clamd) and > thread-manager (always spawned by LinuxThreads). So it is correct to only use gdb with the first process (main thread of clamd)? Or is it necessary to also include backtr

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > Oh, you're right - there was no chance to disable the timeout (however > clamav.conf states that 0 disables the limit). It's even better to use: > > if(timeout && ths[i].active) > > instead of > > if(timeout && (time(NULL) - ths[i].start > timeout)) >

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 13:27:16 + (GMT) Trog <[EMAIL PROTECTED]> wrote: > Quoting Philipp Grosswiler <[EMAIL PROTECTED]>: > > > > > Timed out after 3 seconds! Thats not right. > > > > > > A quick look at the code, and it seems that the thread > > > timeout code isn't correct. > > > > > > It

Re: [Clamav-users] clamd backtrace

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 13:32:56 +0100 "Philipp Grosswiler" <[EMAIL PROTECTED]> wrote: > trog, > > I could finally manage to get the backtrace you requested... clamd now > fails almost every 6 hours. here is what I got: Thank you for the backtrace. > I hope it is useful to you. I still don't know w

[Clamav-users] mod_clamav problem compiling

2004-01-15 Thread Vladimir Orlando
Hi, i'm new. My name's Vlad. I'm writing to you because i've a problem compiling mod_clamav. I've just installed clamav following instruction, infact it's up and running. I've apache 2 up and running, but when i compile mod_clamav it returns me an error. this is command: ./configure --with-apxs

RE: [Clamav-users] clamd protocol

2004-01-15 Thread Philipp Grosswiler
> Do: > > cd /clamav-0.65/clamd > patch -p0 < /path/to/clamd.timeout.patch > > and in clamav.conf set this: > > ThreadTimeout 0 Thank you for the patch, I will apply it and re-compile clamd. I also saw in the log file, that whenever clamd crashes, the last line logged is something like this:

RE: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Philipp Grosswiler <[EMAIL PROTECTED]>: > > Timed out after 3 seconds! Thats not right. > > > > A quick look at the code, and it seems that the thread > > timeout code isn't correct. > > > > It is also possible that there is a mutex locking bug in clamd. > > Could this be the cause of

Re: [Clamav-users] clamd backtrace

2004-01-15 Thread Trog
Quoting Philipp Grosswiler <[EMAIL PROTECTED]>: > trog, > > I could finally manage to get the backtrace you requested... clamd now > fails > almost every 6 hours. here is what I got: > Thanks. > > I hope it is useful to you. I still don't know why there are actually 3 > PIDs > for clamd. Co

[Clamav-users] clamd backtrace

2004-01-15 Thread Philipp Grosswiler
trog, I could finally manage to get the backtrace you requested... clamd now fails almost every 6 hours. here is what I got: (gdb) bt #0 0x40093b94 in __pthread_sigsuspend () from /lib/i686/libpthread.so.0 #1 0x400939d8 in __pthread_wait_for_restart_signal () from /lib/i686/libpthread.so.0 #2

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread Nigel Horne
On Thursday 15 Jan 2004 11:32 am, EyedMax wrote: > FREE-BSD 4.4-RELEASE I only have 4.7 and 4.8 (4.4 is rather old now) so I can't be 100% sure this will work for you. I suggest downloading the latest sendmail source from sendmail.org, cd to libmilter and doing 'make install' there. Report back

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread EyedMax
Nigel Horne wrote: On Thursday 15 Jan 2004 10:36 am, EyedMax wrote: How can I do it? That depends on the operating system you are using. FREE-BSD 4.4-RELEASE -- //EyedMax --- This SF.net email is sponsored by: Perforce Software. Perforce is

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > On Thu, 15 Jan 2004 09:49:22 + (GMT) > Trog <[EMAIL PROTECTED]> wrote: > > > [EMAIL PROTECTED] gale]$ clamdscan . > > /home/gale/./.mozilla/default/5bc4ycs6.slt/Cache/_CACHE_002_: > > Eicar-Test-Signature FOUND > > Session(0): Time out ERROR > > > >

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Tomasz Kojm <[EMAIL PROTECTED]>: > On Thu, 15 Jan 2004 09:49:22 + (GMT) > Trog <[EMAIL PROTECTED]> wrote: > > > [EMAIL PROTECTED] gale]$ clamdscan . > > /home/gale/./.mozilla/default/5bc4ycs6.slt/Cache/_CACHE_002_: > > Eicar-Test-Signature FOUND > > Session(0): Time out ERROR > > > >

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread Nigel Horne
On Thursday 15 Jan 2004 10:36 am, EyedMax wrote: > How can I do it? That depends on the operating system you are using. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk -

Re: [Clamav-users] clamd protocol

2004-01-15 Thread Tomasz Kojm
On Thu, 15 Jan 2004 09:49:22 + (GMT) Trog <[EMAIL PROTECTED]> wrote: > [EMAIL PROTECTED] gale]$ clamdscan . > /home/gale/./.mozilla/default/5bc4ycs6.slt/Cache/_CACHE_002_: > Eicar-Test-Signature FOUND > Session(0): Time out ERROR > > Timed out after 3 seconds! Thats not right. There was a ra

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread EyedMax
Nigel Horne wrote: This is my old logs. Have you installed the milter SDK yet? As I said, the milter won't build without that. -Nigel How can I do it? -- //EyedMax --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast S

Re: [Clamav-users] paypal trojan

2004-01-15 Thread Antony Stone
On Thursday 15 January 2004 9:55 am, vlad wrote: > # clamscan -v -r --mbox /var/virusmails/ > /var/virusmails//virus-20040114-185021-24369-10: Worm.Gibe.F FOUND > /var/virusmails//virus-20040112-120601-15098-04: Worm.Mimail.J FOUND > /var/virusmails//virus-20040115-141942-25682-04:

RE: [Clamav-users] paypal trojan

2004-01-15 Thread Diego d'Ambra
> -Original Message- > From: [EMAIL PROTECTED] [mailto:clamav-users- > [EMAIL PROTECTED] On Behalf Of vlad > Sent: 15. januar 2004 10:55 > To: Trog > Subject: Re: [Clamav-users] paypal trojan > > Hello Trog, > > Thursday, January 15, 2004, 2:23:33 PM, you wrote: > > T> Hi all, > > T> Ha

RE: [Clamav-users] clamd protocol

2004-01-15 Thread Philipp Grosswiler
> clamd will be linked against libpthread, the command 'ldd > /usr/local/sbin/clamd' should so this. The command shows the following output: libclamav.so.1 => /usr/local/lib/libclamav.so.1 (0x4001a000) libz.so.1 => /lib/libz.so.1 (0x4003c000) libbz2.so.1 => /usr/lib/libbz

Re: [Clamav-users] paypal trojan

2004-01-15 Thread Trog
Quoting vlad <[EMAIL PROTECTED]>: > > # more /var/virusmails/virus-20040113-120704-22122-02 > Return-Path: <[EMAIL PROTECTED]> > Delivered-To: virus-quarantine > X-Envelope-To: <[EMAIL PROTECTED]> > X-Envelope-From: <[EMAIL PROTECTED]> > X-Quarantine-id: > Received: from localhost (172-122.sta

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread Nigel Horne
On Thursday 15 Jan 2004 8:27 am, EyedMax wrote: > This is my old logs. Have you installed the milter SDK yet? As I said, the milter won't build without that. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.u

Re: [Clamav-users] paypal trojan

2004-01-15 Thread vlad
ils//virus-20040114-185021-24369-10: Worm.Gibe.F FOUND /var/virusmails//virus-20040112-120601-15098-04: Worm.Mimail.J FOUND /var/virusmails//virus-20040115-141942-25682-04: Worm.Gibe.F FOUND /var/virusmails//virus-20040115-141944-25683-04: Worm.Gibe.F FOUND /var/virusmails//virus-20040114-195750-29402-06: Worm.

RE: [Clamav-users] clamd protocol

2004-01-15 Thread Trog
Quoting Philipp Grosswiler <[EMAIL PROTECTED]>: > OK, clamd already crashed once again, and now I was trying to follow > your > guide... > > > (I'm going to assume you're clamd is multithreaded. If not > > just do steps 1-3 followed by the command 'bt'). > > I think so, how can I tell? clamd w

Re: [Clamav-users] Problems running clamdscan

2004-01-15 Thread Trog
Quoting "Jon R. Kibler" <[EMAIL PROTECTED]>: > Hello: > > Running: > Solaris 9 > Clavav 0.65 > > We are having problems getting clamdscan to work. > > The problem is file permissions. The file being scanned must be either > other readable, or it must belong to the clamav user or group. We

[Clamav-users] paypal trojan

2004-01-15 Thread Trog
Hi all, Have submitted a sample of an email message doing the rounds purporting to be from paypal and containing a zip file with an executable in it. Kaspersky identified the message as: paypal.exe Packed: UPX paypal.zip/paypal.exe Infected: TrojanDownloader.Win32.Small.cz Clam doesn't recongni

Re: [Clamav-users] clamav-milter compile problem

2004-01-15 Thread EyedMax
Ing. Germán González B. wrote: I can't compile clamav-milter on my FREE-BSD 4.4-RELEASE system :( Everything looks fine, except a few warnings about crypt, but no errors... clamav-milter itself isn't appears after make. Did you configure with --enable-milter option? Regards Yes. I can recompile an