Re: [Clamav-users] The Sasser worm

2004-05-14 Thread Christoph Cordes
On Saturday, May 15, 2004, 12:49:03 AM, Michael St. Laurent wrote: MSL> I know that Clamav has signatures in the database for the various species of MSL> the Sasser worm and when I check the sigtool database they are listed. MSL> What's the problem then you ask? There is not a single instance in

Re: [Clamav-users] The Sasser worm

2004-05-14 Thread Jakub Jankowski
On 2004-05-14, Michael St. Laurent wrote: What's the problem then you ask? There is not a single instance in our log files of it hitting our filter. We've got *plenty* of others being logged like Bagel, SomeFool, MyDoom, Gibe, Sober, BugBear, etc. No Sasser though. This worries me. :-( I feel

Re: [Clamav-users] The Sasser worm

2004-05-14 Thread Patrick Boutilier
Michael St. Laurent wrote: I know that Clamav has signatures in the database for the various species of the Sasser worm and when I check the sigtool database they are listed. What's the problem then you ask? There is not a single instance in our log files of it hitting our filter. We've got *ple

Re: [Clamav-users] The Sasser worm

2004-05-14 Thread Mike Robinson
This is because the Sasser worm doesn't spread through E-Mail. The ID is there so that you can scan for the file AVSERVE2.EXE. The identification is included primarily for those folks that scan Windoze machines via Samba. Regards, Mike --- Begin Message --- I know that Clamav has signatures in t

Re: [Clamav-users] Re: SomeFool.Q passed the clamscan & clamav-milter

2004-05-14 Thread Tomasz Kojm
On Fri, 14 May 2004 18:24:33 -0400 (EDT) James Chamberlain <[EMAIL PROTECTED]> wrote: > Martin Chan wrote: > > Today I found a virus passed through the clamav-milter, and I tried > > to manual scan it with "clamscan --mbox", but it passed too. > > > > I'm sure my virus definition is updated and I

[Clamav-users] The Sasser worm

2004-05-14 Thread Michael St. Laurent
I know that Clamav has signatures in the database for the various species of the Sasser worm and when I check the sigtool database they are listed. What's the problem then you ask? There is not a single instance in our log files of it hitting our filter. We've got *plenty* of others being logged

[Clamav-users] Re: SomeFool.Q passed the clamscan & clamav-milter

2004-05-14 Thread James Chamberlain
Martin Chan wrote: > Today I found a virus passed through the clamav-milter, and I tried to > manual scan it with "clamscan --mbox", but it passed too. > > I'm sure my virus definition is updated and I'm using > clamscan / ClamAV version 0.70 > > Scan in "Online scanner" does detect it: > > /tmp

Re: [Clamav-users] Clamdscan failure (noob)

2004-05-14 Thread Brian
That did the trick. Now I've got to go scrape the egg off my face ;-) Thanks again for the help. Brian On 5/14/04 1:17 PM, "steve weiland" <[EMAIL PROTECTED]> wrote: > Looks like the user clamd is running under > can't access: /root/MailServerInstall/clamav_stuff/clamav-0.70 > > look at: >

Re: [Clamav-users] Clamdscan failure (noob)

2004-05-14 Thread steve weiland
Looks like the user clamd is running under can't access: /root/MailServerInstall/clamav_stuff/clamav-0.70 look at: User clamav in: /path/to/clamav.conf if you run the scan again on a dir the "User" can read all should be well. On Fri, 2004-05-14 at 09:17, Brian wrote: > Hi all, > > We're m

RE: [Clamav-users] Clamdscan failure (noob)

2004-05-14 Thread Jim Maul
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Brian > Sent: Friday, May 14, 2004 12:18 PM > To: [EMAIL PROTECTED] > Subject: [Clamav-users] Clamdscan failure (noob) > > > Hi all, > > We're moving our mail server (CommuniGatePro) from OS X to RedHat >

Re: [Clamav-users] Clam virus scanning through procmail

2004-05-14 Thread Stephen Gran
On Thu, May 13, 2004 at 10:50:41AM -0500, Kenneth Andresen said: > Hello all, > > I am in a position where I can't add milter to sendmail due to having > Redhat Enterprise ES2.1 server and thus loose support on sendmail by > recompiling it... > > I do believe however that it should be possible to

[Clamav-users] Clamdscan failure (noob)

2004-05-14 Thread Brian
Hi all, We're moving our mail server (CommuniGatePro) from OS X to RedHat Enterprise Linux 3. We've been using cgvirusscan, but that only works on OS X so were making the move to Clamav (using cgpav as a plugin). I've never used clamav before, so am a noobie. I've got everything installed and c