Re: [Clamav-users] Creating your own Signatures: Bound Offset

2008-01-25 Thread Karsten Bräckelmann
On Fri, 2008-01-25 at 18:41 -0800, Dennis Peterson wrote: > Karsten Bräckelmann wrote: > > On Fri, 2008-01-25 at 17:54 -0800, Dennis Peterson wrote: > >> The sigs are full of unbound RE's. That's why scanning mbox mail files is > >> pointless. > > > > Yes, I know. I contributed that fact to the

Re: [Clamav-users] Creating your own Signatures: Bound Offset

2008-01-25 Thread Dennis Peterson
Karsten Bräckelmann wrote: > On Fri, 2008-01-25 at 17:54 -0800, Dennis Peterson wrote: >> Karsten Bräckelmann wrote: >> >>> The main purpose was, to keep ClamAV from scanning the entire, possibly >>> large file (err, mail). And maybe even speed it up. It's good practice >>> to bound your REs or wil

Re: [Clamav-users] Creating your own Signatures: Bound Offset

2008-01-25 Thread Karsten Bräckelmann
On Fri, 2008-01-25 at 17:54 -0800, Dennis Peterson wrote: > Karsten Bräckelmann wrote: > > > The main purpose was, to keep ClamAV from scanning the entire, possibly > > large file (err, mail). And maybe even speed it up. It's good practice > > to bound your REs or wildcards anyway. > > > > I wond

Re: [Clamav-users] Creating your own Signatures: Bound Offset

2008-01-25 Thread Dennis Peterson
Karsten Bräckelmann wrote: > > The main purpose was, to keep ClamAV from scanning the entire, possibly > large file (err, mail). And maybe even speed it up. It's good practice > to bound your REs or wildcards anyway. > > I wonder, if this indeed would speed up scanning, however small, of > large

[Clamav-users] Creating your own Signatures: Bound Offset

2008-01-25 Thread Karsten Bräckelmann
So I finally got around to writing some (well, one for now ;) custom signatures. There's currently a highly annoying, lame phishing attempt I want to swat early. Anyway, while playing with the sigs and trying some optimization, the sig broke horribly for some weird reason. Please see below for a s

Re: [Clamav-users] help-about regular expressions in signatures

2008-01-25 Thread Kris Deugau
xue wen wrote: > To whom it may concern, > > I have tried to understand the signatures in the ClamAV's database. I have > succeeded to add a string signature into .db file. And when I tried to add a > regular expression into signature, there were some errors. I have referred > to the document of s

Re: [Clamav-users] Password Protected ZIP Files

2008-01-25 Thread Donald Johnson
Dennis Peterson wrote: > In my environment I use a milter to call clamav and it allows me to skip av > testing based on several criteria including To: and From: addresses. > Perhaps you have something similar. We are using Zimbra, I am not sure if there is a way to specify to skip av scan from a s

Re: [Clamav-users] Password Protected ZIP Files

2008-01-25 Thread Dennis Peterson
Donald Johnson wrote: > I have a process which generates a ZIP file and emails it... This file is > REQUIRED to be Password protected. > > The password is the same every time it is generated, and it goes to the same > recipients each time... > > I really don't want to turn off the feature to

Re: [Clamav-users] Password Protected ZIP Files

2008-01-25 Thread Hostmaster
>I have a process which generates a ZIP file and emails it... This file is >REQUIRED to be Password protected. >The password is the same every time it is generated, and it goes to the same >recipients each time... >I really don't want to turn off the feature to block Encrypted ZIP files...

[Clamav-users] Password Protected ZIP Files

2008-01-25 Thread Donald Johnson
I have a process which generates a ZIP file and emails it... This file is REQUIRED to be Password protected. The password is the same every time it is generated, and it goes to the same recipients each time... I really don't want to turn off the feature to block Encrypted ZIP files... Is th

Re: [Clamav-users] help-about regular expressions in signatures

2008-01-25 Thread Török Edwin
xue wen wrote: > LibClamAV Error: cli_parse_add(): Problem adding signatures (2). > Problem parsing signature at line 1 > Problem parsing database at line 1 > Can't load daily.db: Malformed database > Wildcard signatures go into a .ndb file. > ERROR: Malformed database > > Are there regular ex

[Clamav-users] help-about regular expressions in signatures

2008-01-25 Thread xue wen
To whom it may concern, I have tried to understand the signatures in the ClamAV's database. I have succeeded to add a string signature into .db file. And when I tried to add a regular expression into signature, there were some errors. I have referred to the document of signatures.pdf and followed

Re: [Clamav-users] Clamav Update Database

2008-01-25 Thread Rob MacGregor
On Jan 25, 2008 12:53 PM, Clovis Tristao <[EMAIL PROTECTED]> wrote: > Hi All, > > I'm using Clamav in Server Fedora Core. > Please, How I up to date clamav databases automatically and I receive > e-mails saying that the system was brought up to date? Take a look at OnUpdateExecute in freshclam.con

Re: [Clamav-users] Clamav Update Database

2008-01-25 Thread Steven Stern
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/25/2008 06:53 AM, Clovis Tristao wrote: | Hi All, | | I'm using Clamav in Server Fedora Core. | Please, How I up to date clamav databases automatically and I receive | e-mails saying that the system was brought up to date? | Thanks a lot, The

[Clamav-users] Clamav Update Database

2008-01-25 Thread Clovis Tristao
Hi All, I'm using Clamav in Server Fedora Core. Please, How I up to date clamav databases automatically and I receive e-mails saying that the system was brought up to date? Thanks a lot, Clóvis -- Clovis Tristao - UNICAMP/Faculdade de Engenharia Agricola Administrador de Redes - Secao de Infor