Re: [Clamav-users] problem with freshclam

2005-11-05 Thread Dennis Peterson
xasoft xa soft said: > hello. > first I'm sorry because I don't speak english, but I have a problem with > freshclam. > this is my question, when I update clamav (./freshclam) I see in the > console > : > > ERROR:Can't get information about user clamav. > > what can I do? > > thank you > > Xavi Co

[Clamav-users] Re: problem with freshclam

2005-11-05 Thread René Berber
xasoft xa soft wrote: > first I'm sorry because I don't speak english, but I have a problem with > freshclam. > this is my question, when I update clamav (./freshclam) I see in the > console : > > ERROR:Can't get information about user clamav. > > what can I do? Freshclam tries to run as user

[Clamav-users] problem with freshclam

2005-11-05 Thread xasoft xa soft
hello. first I'm sorry because I don't speak english, but I have a problem with freshclam. this is my question, when I update clamav (./freshclam) I see in the console : ERROR:Can't get information about user clamav. what can I do? thank you Xavi Comes [EMAIL PROTECTED]

Re: [Clamav-users] Update: Worm/Virus related to SID 3813: "WEB-CGI awstats.pl configdir command execution attempt" and other SIDs ?

2005-11-05 Thread Niek
On 11/5/2005 4:43 PM +0200, [EMAIL PROTECTED] wrote: Hi, I couldn't help it and I ran the program, of course with a sniffer on. Syntax: lupii Here's what I found: 1. runs on RedHat Enterprise Workstation 4 2. opens up udp:7222 3. Exchanges some info with over udp 7222 4. remains active in

[Clamav-users] Update 2: Worm/Virus related to SID 3813: "WEB-CGI awstats.pl configdir command execution attempt" and other SIDs ?

2005-11-05 Thread TPanaitescu
It seems that this a variant or so ? Please check http://isc.sans.org/ for the same thing but diffferent port, udp 7111 Tudor ___ http://lurker.clamav.net/list/clamav-users.html

[Clamav-users] Update: Worm/Virus related to SID 3813: "WEB-CGI awstats.pl configdir command execution attempt" and other SIDs ?

2005-11-05 Thread TPanaitescu
Hi, I couldn't help it and I ran the program, of course with a sniffer on. Syntax: lupii Here's what I found: 1. runs on RedHat Enterprise Workstation 4 2. opens up udp:7222 3. Exchanges some info with over udp 7222 4. remains active in the background 5. starts a SYN scan to port 80 on random

[Clamav-users] RE: Worm/Virus related to SID 3813: "WEB-CGI awstats.pl configdir command execution attempt" and other SIDs ?

2005-11-05 Thread TPanaitescu
Hi again everyone, Got the same thing few minutes ago, coming from China this time, pointing to the same address for the download Seems to be spreading ? The downloaded file is definitely for Linux. Tudor __ Hi everyone, Last night I caught an attack to my web servers he

Re: [Clamav-users] Problem to check virus within RAR archives ?

2005-11-05 Thread Stephan von Krawczynski
On Sat, 5 Nov 2005 12:53:11 +0100 Tomasz Kojm <[EMAIL PROTECTED]> wrote: > On Sat, 5 Nov 2005 11:26:44 +0100 > Stephan von Krawczynski <[EMAIL PROTECTED]> wrote: > > > > Clamscan and clamdscan are two different things. > > > > That is exactly what I wanted to express. But as far as I understand

Re: [Clamav-users] Problem to check virus within RAR archives ?

2005-11-05 Thread Brian Morrison
On Sat, 5 Nov 2005 11:26:44 +0100 in [EMAIL PROTECTED] Stephan von Krawczynski <[EMAIL PROTECTED]> wrote: > > > > Clamscan and clamdscan are two different things. > > That is exactly what I wanted to express. But as far as I understand > the design the idea is that clamdscan can equally replace

Re: [Clamav-users] Problem to check virus within RAR archives ?

2005-11-05 Thread Tomasz Kojm
On Sat, 5 Nov 2005 11:26:44 +0100 Stephan von Krawczynski <[EMAIL PROTECTED]> wrote: > > Clamscan and clamdscan are two different things. > > That is exactly what I wanted to express. But as far as I understand the > design > the idea is that clamdscan can equally replace clamscan, apart from t

Re: [Clamav-users] Problem to check virus within RAR archives ?

2005-11-05 Thread Stephan von Krawczynski
On Fri, 4 Nov 2005 18:01:33 + Matt Fretwell <[EMAIL PROTECTED]> wrote: > Stephan von Krawczynski wrote: > > > 04/11/2005 14:17:07:26333: run /usr/local/bin/clamdscan -r > > --tempdir=/var/spool/qmailscan/mail-a02113111022758026333 > > --disable-summary --unzip --unrar --unace --unarj --zoo --