[Clamav-users] Find bagle in Zip files.

Hello. Im running a smtp server with f-secure and clamav. I have a problem with the f-secure server because it cant find the bagle virus in password protected zip files but clamav does. I e-mailed f-secure support about and they said to me it isnt any virus scanner today that can find virus in pas

Re: [Clamav-users] conbination with spamassasin

Joe's Web Hosting $B!!(B-- $B;3EDHello. (B> (B>I installed amavis under exim. (B>They communicate themselves each other. (B>I found spamassasin in exim does not work (B> if the router and transport are ON. (B>The problem occurs because (B>exim is regarded as a outer command and (B>exi

Re: [Clamav-users] clam not fresh

At 07:09 PM 3/25/04, you wrote: >On Thu, 25 Mar 2004 at 18:39:29 -0800, Brian W. Antoine wrote: >> At 05:24 PM 3/25/04, Tomasz Papszun wrote: >> >On Thu, 25 Mar 2004 at 16:18:38 -0800, Brian W. Antoine wrote: >> >> >> >> I'm updating from clamav.elektrapro.com and starting a short time ago it >

[Clamav-users] conbination with spamassasin

Hello. (B (BI installed amavis under exim. (BThey communicate themselves each other. (BI found spamassasin in exim does not work (B if the router and transport are ON. (BThe problem occurs because (Bexim is regarded as a outer command and (Bexim is executed infinitely many times. (B (B

Re: [Clamav-users] reject=451 4.7.1 Please try again later

I have been having the same as well. I added some more verbosity into the syslog statement and got this logged write failure to clamd, nbytes: -1, quarantine_dir: (null), error: Bad file descriptor Any ideas? --- This SF.Net email is spon

Re: [Clamav-users] clam not fresh

On Thu, 25 Mar 2004 at 18:39:29 -0800, Brian W. Antoine wrote: > At 05:24 PM 3/25/04, Tomasz Papszun wrote: > >On Thu, 25 Mar 2004 at 16:18:38 -0800, Brian W. Antoine wrote: > >> > >> I'm updating from clamav.elektrapro.com and starting a short time ago it > >> now wants > >> to update viruses.

Re: [Clamav-users] Application to generate CLAMAV report

[EMAIL PROTECTED] wrote: This site hosting the file seems be be over the limit. Anyone else have some extra space to host the file. Thanks. It's also available on http://clamav.or.id/contrib/emailavlog/ It would be great if you could also put some installation instruction there. Regards, Fajar

Re: [Clamav-users] Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

On Thu, 25 Mar 2004 14:26:05 -0500 Jesse Guardiani <[EMAIL PROTECTED]> wrote: > Tomasz Kojm wrote: > > > On Mon, 22 Mar 2004 15:54:18 -0500 > > Jesse Guardiani <[EMAIL PROTECTED]> wrote: > > > >> Any ideas on how to avoid this in the future? I'm running with > >> ScanArchive and ScanMail (becaus

[Clamav-users] Re: Clamav error

Thiago Taranto wrote: > Does any body kows why is this happening? > > > 17178 ?S 0:00 /usr/bin/clamdscan -r --disable-summary > --max-recursion=20 --max-space=9 > /var/spool/qmailscan/korn108007258045617052 > 17201 ?S 0:00 /usr/bin/clamdscan -r --disable-summary

Re: [Clamav-users] Application to generate CLAMAV report

* Ralph Angenendt <[EMAIL PROTECTED]> [20040325 14:04]: wrote: > Dilip M wrote: > > I have > > # rpm -qa|grep clam > > clamav-0.67-1 > > clamav-devel-0.67-1 > > > > > > # exim -bV > > How can i get this work my side ? > > On

RE: [Clamav-users] SurgeMail and Clamav

Yes we have it working flawlessly here on FreeBSD_4 with the latest clamv devel releases and the latest version of Surgemail. We've been running it for a while with a lot of success as of late. The stability has greatly improved. We're using a custom PERL handler which marshals the virus scans (

Re: [Clamav-users] clam not fresh

At 05:24 PM 3/25/04, Tomasz Papszun wrote: >On Thu, 25 Mar 2004 at 16:18:38 -0800, Brian W. Antoine wrote: >> >> I'm updating from clamav.elektrapro.com and starting a short time ago it >> now wants >> to update viruses.db, but the checksum fails after the download. The >> mirror at ozforces

[Clamav-users] Help with clamav-milter.sh

The startup script “clamav-milter.sh” Makes a few calls to init.d. I am on a Virtual Private Server so I do not have init.d available to me. All I have is rc.d. How can I then get clamav-milter to start when I reboot my server? Thanks

Re: [Clamav-users] Segmentation fault in clamav-0.70rc-1

On Thu, 2004-03-25 at 08:36, Claudio Alonso wrote: > Hi, > Yesterday I installed clamav-0.70rc-1 from rpm on my RedHat 9.0 (kernel 2.4.20-30.9) > and started > clamd just to test it's current stability > The computer was on all night and today I found the following in the rotated logs: > Thu Mar 2

[Clamav-users] SurgeMail and Clamav

Has anyone tried to run clamav with SurgeMail?   Thanks

Re: [Clamav-users] clam not fresh

On Thu, 25 Mar 2004 at 16:18:38 -0800, Brian W. Antoine wrote: > > I'm updating from clamav.elektrapro.com and starting a short time ago it > now wants > to update viruses.db, but the checksum fails after the download. The > mirror at ozforces > does the same thing. > > This isn't the issu

Re: [Clamav-users] clam not fresh

At 02:56 PM 3/25/2004, you wrote: On Thursday 25 March 2004 10:36 pm, Mark Novak wrote: > > If running the same command on your server does not show the > > SomeFool.P then > > your definitions are NOT up to date. If freshclam insists on saying > > they > > are up to date, i would try deleting th

Re: [Clamav-users] clam not fresh

On Thu, 25 Mar 2004 at 18:19:02 -0500, Colin A. Bartlett wrote: > > Per Tomasz, I first checked the number of signatures reported by freshclam > and it was reporting the correct number. So Per Jim, I deleted both main.cvd > and daily.cvd from /var/lib/clamav and ran freshclam again. It downloaded

Re: [Clamav-users] clam not fresh

Colin A. Bartlett [EMAIL PROTECTED] wrote: > Jim Maul Sent: Thursday, March 25, 2004 4:28 PM > > > If freshclam insists on saying they > > are up to date, i would try deleting them totally and running freshclam > > again. Maybe that will clear up the problem. > > Per Tomasz, I first checked the

RE: [Clamav-users] clam not fresh

Jim Maul Sent: Thursday, March 25, 2004 4:28 PM > If freshclam insists on saying they > are up to date, i would try deleting them totally and running freshclam > again. Maybe that will clear up the problem. Per Tomasz, I first checked the number of signatures reported by freshclam and it was rep

Re: [Clamav-users] clam not fresh

On Thursday 25 March 2004 10:36 pm, Mark Novak wrote: > > If running the same command on your server does not show the > > SomeFool.P then > > your definitions are NOT up to date. If freshclam insists on saying > > they > > are up to date, i would try deleting them totally and running freshclam >

Re: [Clamav-users] clam not fresh

See below - On Mar 25, 2004, at 3:28 PM, Jim Maul wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Colin A. Bartlett Sent: Thursday, March 25, 2004 2:47 PM To: [EMAIL PROTECTED] Subject: RE: [Clamav-users] clam not fresh Another poster pointed to test

[Clamav-users] email structure logging

Howdy list, Is there any way to make clamd log the structure of a message and it's attachments? BinHex, MIME, plain-text, ZIP, RAR, BZIP, GZIP, OLE2, etc...? This information would be great for statistics, but I could imagine it being useful during troubleshooting or tech support also. -- Jesse

[Clamav-users] Re: Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

Tomasz Papszun wrote: [...] > 2) clamdscan can be configured (in clamav.conf) to use more features > than you requested for clamscan in command line (e.g. ScanMail). If so, > scanning with clamdscan can require more resources than simple > 'clamscan'. I think that is exactly what is happening. I

[Clamav-users] Re: Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

Robert Blayzor wrote: [...] > I still think there is a bug out there somewhere when scanning mail files. > Rarely we'll see clamd+clamdscan take quite a long time to process a mail > message. It happens rarely, but sometimes a 4K message file can take a > minute to scan. What is your MaxThreads

RE: [Clamav-users] clam not fresh

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Colin A. > Bartlett > Sent: Thursday, March 25, 2004 2:47 PM > To: [EMAIL PROTECTED] > Subject: RE: [Clamav-users] clam not fresh > > > > Another poster pointed to testvirus.org for testing. I think you'

Re: [Clamav-users] Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

On Thu, 25 Mar 2004 at 14:26:05 -0500, Jesse Guardiani wrote: [...] > The only thing I still don't understand is why clamscan is so > much faster than clamdscan, and why clamscan only uses 25M > of process memory while clamdscan uses over 298M of process > memory during the scan: > > --- S

RE: [Clamav-users] clam not fresh

Colin A. Bartlett said: >> Another poster pointed to testvirus.org for testing. I think >> you'll >> find some methods of delivery more effective than others and that >> clamav will miss some of these. > > They're not being detected by clam even when running them right > through > clamscan on the

[Clamav-users] OLE2 archives

Howdy list, Is there a utility I can download to generate OLE2 archives, or does anyone have an OLE2 archive with an EICAR virus inside that I can use for testing? I'm putting my ClamAV installations through various stress tests, and the only archive format I can't generate from FreeBSD seems to

Re: [Clamav-users] Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

On 3/25/04 2:26 PM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote: > --- SCAN SUMMARY --- > Known viruses: 20702 > Scanned directories: 0 > Scanned files: 1 > Infected files: 0 > Data scanned: 57.21 MB > I/O buffer size: 131072 bytes > Time: 11.989 sec (0 m 11 s) > [13:[EMAIL PROTECT

RE: [Clamav-users] clam not fresh

> Another poster pointed to testvirus.org for testing. I think you'll > find some methods of delivery more effective than others and that > clamav will miss some of these. They're not being detected by clam even when running them right through clamscan on the command prompt. I think it's because

Re: [Clamav-users] Freshclam died

On 25 Mar 2004 16:41:21 +0100 Tarjei Knapstad <[EMAIL PROTECTED]> wrote: > On Tue, 2004-03-16 at 21:03, Tomasz Kojm wrote: > > On Tue, 16 Mar 2004 11:28:53 -0500 > > "Jim Maul" <[EMAIL PROTECTED]> wrote: > > > > > > -- > > > ClamAV update process started at Su

[Clamav-users] Re: clamav 0.70-rc on FreeBSD 4.8-RELEASE

Tomasz Kojm wrote: > On Mon, 22 Mar 2004 15:54:18 -0500 > Jesse Guardiani <[EMAIL PROTECTED]> wrote: > >> Any ideas on how to avoid this in the future? I'm running with >> ScanArchive and ScanMail (because I want the binhex feature on). > > The problem may be connected with already discussed and

Re: [Clamav-users] new clamav user - comparison to amavisd with uvscan

Never-Mind. Standard database path screwup. Joe Maimon wrote: Hello All, I am new here, I hope this hasnt been hashed to death already. I recently installed clamav into a production email system, using clamav-milter. This system had been operating with amavisd and uvscan (nai's command line

[Clamav-users] outlook problem

Hi ppl, I have a problem (my english first!). I have a lan where for citrix problem the gw is a soho watchgard firewall and where a machine from the lan works for proxi with squid. Now i tried to put on the same proxi machine clamav and p3scan to work togheter. Everithing seems works fine in the lo

Re: [Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1" (clamav-users: addressed to exclusive sender for this address)

no, i've turned of bounce notification ages ago for the very same reason. the notices i'm getting are simply reports to 'postmaster' ... since, i've REBOOTED, i'm now seeing ClamAV via CGPAV "find" *and* discard the "Fool" viruses ... i.e., working again. i have no clue as to what was going on,

[Clamav-users] new clamav user - comparison to amavisd with uvscan

Hello All, I am new here, I hope this hasnt been hashed to death already. I recently installed clamav into a production email system, using clamav-milter. This system had been operating with amavisd and uvscan (nai's command line scanner) for years. Now email is scanned twice, first by clamav-

Re: [Clamav-users] clam not fresh

On Thu, 25 Mar 2004 at 9:52:26 -0500, Colin A. Bartlett wrote: > > I've upgraded my ClamAV and I'm no longer getting errors on freshclam. > However it doesn't seem to be updated. I noticed some viruses slipping > through and ran them through the online scanner. Some were identified as > SomeFool.

RE:[Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1"

> I have the same issue on Linux when checking email in KMail. If I save the attachment > to my desktop and check it there, then the virus is detected. My definitions are > bang up to date; the virus has been getting missed for the past couple of days at > least; the string I use for checking my em

Re: [Clamav-users] clam not fresh

Colin A. Bartlett said: > Hello All > > I've upgraded my ClamAV and I'm no longer getting errors on > freshclam. > However it doesn't seem to be updated. I noticed some viruses > slipping > through and ran them through the online scanner. Some were > identified as > SomeFool.P. I grepped my sigtool

[Clamav-users] Segmentation fault in clamav-0.70rc-1

Hi, Yesterday I installed clamav-0.70rc-1 from rpm on my RedHat 9.0 (kernel 2.4.20-30.9) and started clamd just to test it's current stability The computer was on all night and today I found the following in the rotated logs: Thu Mar 25 04:02:33 2004 -> No stats for Database check - forcing reload

Re: [Clamav-users] Freshclam died

On Tue, 2004-03-16 at 21:03, Tomasz Kojm wrote: > On Tue, 16 Mar 2004 11:28:53 -0500 > "Jim Maul" <[EMAIL PROTECTED]> wrote: > > > -- > > ClamAV update process started at Sun Mar 7 17:31:59 2004 > > ERROR: Maximal time (1200 seconds) reached. > > We are awar

Re: [Clamav-users] Freshclam died

On Wed, 2004-03-17 at 16:20, Bart Silverstrim wrote: > > On Mar 16, 2004, at 10:13 PM, Steven P. Donegan wrote: > > > This is assuming everyone's clocks are set in sync? :-) > You don't use ntpd? :) -- Tarjei --- This SF.Net email is sp

RE: [Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1" on OSX

Hrm. My 0.65 install is picking up Worm.SomeFool.Gen-1, Worm.SomeFool.P, Worm.SomeFool, and Worm.SomeFool.Gen-2 (7%, 2%, 2% and 2% of viruses going through that server, respectively) with qmail-scanner. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Tomas

Re: [Clamav-users] RE: memory leak?

On Thu, 2004-03-25 at 08:56 +, Trog wrote: > Well, you appear to be the only one seeing a leak. We (the devs) do > check for memory leaks quite frequently, and so are pretty sure there > are no big leaks. Does that include the RAR scanner? I have yet to enable it because of the comments in t

[Clamav-users] clam not fresh

Hello All I've upgraded my ClamAV and I'm no longer getting errors on freshclam. However it doesn't seem to be updated. I noticed some viruses slipping through and ran them through the online scanner. Some were identified as SomeFool.P. I grepped my sigtool -l list for SomeFool and .P isn't liste

[Clamav-users] clamav-milter sendmail

Hello ClamAV version 0.68-1 clamav-milter version 0.67a I've successfully installed clam with clam milter and anything getting send via sendmail is being scanned. Now what I want is to scan mail users directories, as we don't run an externally accessible smtp service. Am I tree-barking or is t

[Clamav-users] Clamav error

Does any body kows why is this happening? 17178 ?S 0:00 /usr/bin/clamdscan -r --disable-summary --max-recursion=20 --max-space=9 /var/spool/qmailscan/korn108007258045617052 17201 ?S 0:00 /usr/bin/clamdscan -r --disable-summary --max-recursion=20 --max-space=9

Re: [Clamav-users] Milter reject something with no reason (new)

> I have now an email with attachment which is rejected with this error > (Milter: data, reject=451 4.7.1 Please try again later) - reproducable. > Are the developers interested? Where to send it? Are you using any other milters? When ever I see that message it is always an indication that the oth

Re: [Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1" on OSX

On Wed, 24 Mar 2004 21:31:02 + Steve King <[EMAIL PROTECTED]> wrote: > > all three of (1) latest head build, (2) 0.70rc and  (3) 0.67 of > > clamav on OSX 10.3.3 are missing 100% of the "Worm.SomeFool.Gen-1" > > virus.  clamav is being called via the CGPAV script from > > CommuniGatePro ... >

Re: [Clamav-users] Milter reject something with no reason (new)

On Thu, 25 Mar 2004 11:10:21 +0100 "Clamav" <[EMAIL PROTECTED]> wrote: > I have now an email with attachment which is rejected with this error > (Milter: data, reject=451 4.7.1 Please try again later) - > reproducable. Are the developers interested? Where to send it? Please send it to [EMAIL PRO

Re: [Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1" on OSX

> all three of (1) latest head build, (2) 0.70rc and  (3) 0.67 of clamav on > OSX 10.3.3 are missing 100% of the "Worm.SomeFool.Gen-1" virus.  clamav is > being called via the CGPAV script from CommuniGatePro ... > > its doing a fine job on almost all others ... > > my second stage virus checker, M

Re: [Clamav-users] Re: Time of signature in Virus DB Search

On Tue, 23 Mar 2004 14:08:32 -0500 Jesse Guardiani <[EMAIL PROTECTED]> wrote: > Peter Bonivart wrote: > > > I just noticed the new Virus DB Search function on the web site. > > That's great, I will use that often but could you add the date and > > time (GMT) the signature was added. I often get a

Re: [Clamav-users] Milter reject something with no reason (new)

On Thursday 25 Mar 2004 10:10 am, Clamav wrote: > I have now an email with attachment which is rejected with this error > (Milter: data, reject=451 4.7.1 Please try again later) - reproducable. > Are the developers interested? Where to send it? Please send me a copy of the email. > Best regards >

Re: [Clamav-users] Milter reject something with no reason (new)

i had the same problem. Now i start the milter like this /usr/sbin/clamav-milter --dont-scan-on-error local:/var/run/clamav/clamd-milter.sock BR Adi. B - Original Message - From: "Clamav" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 25, 2004 12:10 PM Subject: [Clamav-

Re: [Clamav-users] Application to generate CLAMAV report

How do I get ClamAV do send out this report? //Regards Jonas - Original Message - From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, March 25, 2004 7:35 AM Subject: [Clamav-users] Application to generate CLAMAV report Dear all, I have created a small application

Re: [Clamav-users] Milter reject something with no reason (new)

On Thu, 2004-03-25 at 10:10, Clamav wrote: > I have now an email with attachment which is rejected with this error > (Milter: data, reject=451 4.7.1 Please try again later) - reproducable. > Are the developers interested? Where to send it? > Please send to [EMAIL PROTECTED], in an encrypted zip

[Clamav-users] Milter reject something with no reason (new)

I have now an email with attachment which is rejected with this error (Milter: data, reject=451 4.7.1 Please try again later) - reproducable. Are the developers interested? Where to send it? Best regards Wolfgang --- This SF.Net email is spons

[Clamav-users] Clamav-milter does not send failure message

Hi! I start clamav-milter with options: clamav-milter --force-scan --noxheader --quarantine-dir=/usr/local/share/clamav/infected --postmaster=virus --postmaster-only --noreject --headers --max-children=20 local:/var/run/clamav/clmilter.sock After starting it send failure message to user virus

Re: [Clamav-users] Application to generate CLAMAV report

Dilip M wrote: > I have > # rpm -qa|grep clam > clamav-0.67-1 > clamav-devel-0.67-1 > > > # exim -bV > How can i get this work my side ? On a machine with amavisd-new clamav *and* kaspersky, I just grep through the mail.log for infected files. If you only have clamav, you might just grep

[Clamav-users] Clamav-milter does not send failure message

Hi! I start clamav-milter with options: clamav-milter --force-scan --noxheader --quarantine-dir=/usr/local/share/clamav/infected --postmaster=virus --postmaster-only --noreject --headers --max-children=20 local:/var/run/clamav/clmilter.sock After starting it send failure message to user virus

Re: [Clamav-users] RE: memory leak?

On Thu, 2004-03-25 at 02:52, Kelsey Cummings wrote: > On Tue, Mar 23, 2004 at 03:17:11PM -0500, Jesse Guardiani wrote: > > Lucas Albers wrote: > > > > > I'm a bit hesitant of upgrading to .68 or .70-rc if it appears to have a > > > memory leak. At what point can the developers say: > > > "this x r

Re: [Clamav-users] Application to generate CLAMAV report

On Thu, 25 Mar 2004 15:33:39 +0700, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote: Bo-Lina teknisk support wrote: Neither of these link's work. I downloaded the programs. It worked, but then I got these : The web site you are trying to access has exceeded its allocated data transfer. Visit our

Re: [Clamav-users] ClamAV missing 100% of "Worm.SomeFool.Gen-1"

waited a bit, and another "Worm.SomeFool.Gen-1" snuck thru ... Are these messages that get through bounced delivery reports by any chance? I think there is an issue with defanging on the current cgpav that means it doesn't treat certain types of bounce messages properly before passing them to c

Re: [Clamav-users] Application to generate CLAMAV report

Bo-Lina teknisk support wrote: Neither of these link's work. I downloaded the programs. It worked, but then I got these : The web site you are trying to access has exceeded its allocated data transfer. Visit our help area for more information.Access to t

RE: [Clamav-users] Application to generate CLAMAV report

This site hosting the file seems be be over the limit. Anyone else have some extra space to host the file. Thanks. Original Message: - From: [EMAIL PROTECTED] [EMAIL PROTECTED] Date: Thu, 25 Mar 2004 02:50:50 -0500 To: [EMAIL PROTECTED] Subject: RE: [Clamav-users] Application to ge

Re: [Clamav-users] Application to generate CLAMAV report

Please try again. Maybe the site is busy. Original Message: - From: Bo-Lina teknisk support [EMAIL PROTECTED] Date: Thu, 25 Mar 2004 08:34:25 +0100 To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] Application to generate CLAMAV report Neither of these link's work. - Origin

RE: [Clamav-users] Application to generate CLAMAV report

Hi there, You have to configure the CLAMAV milter for it to be able to send the report. See "man clamav-milter". Configure it so that it sends the email report to an email address and use that email address for the emailavlog configuration. Sorry, I am not of much help as I did not install