[Clamav-users] what to do about a false positive

2008-02-07 Thread Fred Bacon
Hi, I was scanning my Windows machine and ClamAV identified part of my Intel Fortran compiler as a virus. I uploaded the file to virscan.org and clamav was the only scanner to identify it as a virus. I tried to submit the file online as a false positive, but it was too large. Even zipped up, it

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Rick Macdougall
Noel Jones wrote: > Rick Macdougall wrote: >> Noel Jones wrote: >>> Rick Macdougall wrote: Now, mail server 2 did not see the virus this morning when I checked it again but it obviously did last night when PhishingScanURLs = no. Any reason for that that you can see ? >>> clamsc

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Noel Jones
Rick Macdougall wrote: > Noel Jones wrote: >> Rick Macdougall wrote: >>> Now, mail server 2 did not see the virus this morning when I checked it >>> again but it obviously did last night when PhishingScanURLs = no. >>> >>> Any reason for that that you can see ? >> clamscan doesn't use the options

Re: [Clamav-users] Clamd returned error: Files number limit exceeded

2008-02-07 Thread Leonardo Rodrigues Magalhães
Roberto Ullfig escreveu: We've recently been getting these messages in mimedefang: Clamd returned error: Files number limit exceeded What would the problem be? Thanks! Hmm let me guess . maybe the file number limit is exceeded How about that ??? Check your clamd.co

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Rick Macdougall
Noel Jones wrote: > Rick Macdougall wrote: >> >> Now, mail server 2 did not see the virus this morning when I checked it >> again but it obviously did last night when PhishingScanURLs = no. >> >> Any reason for that that you can see ? > > clamscan doesn't use the options set in clamd.conf. > Ah

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > On Feb 7, 2008 11:12 AM, <[EMAIL PROTECTED]> wrote: >> > Just wanted to update in case anyone else comes across this. Its > actually the mailscanner module for logwatch that trips this up. The > mailscanner module dumps the details of the phishing attack to the > logwat

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread rahlquist
On Feb 7, 2008 11:12 AM, <[EMAIL PROTECTED]> wrote: > > On Feb 7, 2008 10:53 AM, Dennis Peterson <[EMAIL PROTECTED]> wrote: > > [EMAIL PROTECTED] wrote: > > > Thanks for the reply Dennis. The 'virus' is actually a Phishing > > > attempt from the 02/04 def update thats hitting on the logwatch email

[Clamav-users] Clamd returned error: Files number limit exceeded

2008-02-07 Thread Roberto Ullfig
We've recently been getting these messages in mimedefang: Clamd returned error: Files number limit exceeded What would the problem be? Thanks! -- Roberto Ullfig - [EMAIL PROTECTED] ___ Help us build a comprehensive ClamAV guide: visit http://wiki.cla

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread Jason Bertoch
On Thursday, February 07, 2008 10:30 AM [EMAIL PROTECTED] wrote: > > Thu Feb 7 10:27:47 2008 -> > /var/spool/MailScanner/incoming/13948/29EC821AC463.28768.message: > Email.Phishing.RB-2646 FOUND > > Is there any way to find out what that phishing item is hitting on? > Search for Email.Phishin

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Noel Jones
Rick Macdougall wrote: > Noel Jones wrote: >> Rick Macdougall wrote: >>> Hi, >>> >>> I have another example where clamdscan fails to find a virus but >>> clamscan does. >>> >>> [EMAIL PROTECTED] aeiadm]# clamdscan /tmp/180334 >>> /tmp/180334: OK >>> >>> --- SCAN SUMMARY --- >>> Inf

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread rahlquist
On Feb 7, 2008 10:53 AM, Dennis Peterson <[EMAIL PROTECTED]> wrote: > [EMAIL PROTECTED] wrote: > > Thanks for the reply Dennis. The 'virus' is actually a Phishing > > attempt from the 02/04 def update thats hitting on the logwatch email > > here is the line from the clamd.log > > > > Thu Feb 7 10:

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > Thanks for the reply Dennis. The 'virus' is actually a Phishing > attempt from the 02/04 def update thats hitting on the logwatch email > here is the line from the clamd.log > > Thu Feb 7 10:27:47 2008 -> > /var/spool/MailScanner/incoming/13948/29EC821AC463.28768.messag

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread rahlquist
Thanks for the reply Dennis. The 'virus' is actually a Phishing attempt from the 02/04 def update thats hitting on the logwatch email here is the line from the clamd.log Thu Feb 7 10:27:47 2008 -> /var/spool/MailScanner/incoming/13948/29EC821AC463.28768.message: Email.Phishing.RB-2646 FOUND Is t

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Rick Macdougall
Noel Jones wrote: > Rick Macdougall wrote: >> Hi, >> >> I have another example where clamdscan fails to find a virus but >> clamscan does. >> >> [EMAIL PROTECTED] aeiadm]# clamdscan /tmp/180334 >> /tmp/180334: OK >> >> --- SCAN SUMMARY --- >> Infected files: 0 >> Time: 0.033 sec (0

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Noel Jones
Rick Macdougall wrote: > Hi, > > I have another example where clamdscan fails to find a virus but > clamscan does. > > [EMAIL PROTECTED] aeiadm]# clamdscan /tmp/180334 > /tmp/180334: OK > > --- SCAN SUMMARY --- > Infected files: 0 > Time: 0.033 sec (0 m 0 s) > > > [EMAIL PROTE

Re: [Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Török Edwin
Rick Macdougall wrote: > Hi, > > I have another example where clamdscan fails to find a virus but > clamscan does. > > > I have a copy of the message in question if one of the devs would like a > copy. > > Please open a bugreport, and attach the sample (marked as private). Thanks, --Edwin __

Re: [Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread Dennis Peterson
[EMAIL PROTECTED] wrote: > Hello list, > > I run a small mail server with clamd used to scan the incoming and > outgoing email. I recently noticed that I had stopped receiving my > logwatch daily digest. I looked into it and clam is stopping it > claiming its phishing. Is there any way to find out

[Clamav-users] Clamdscan not find viruses

2008-02-07 Thread Rick Macdougall
Hi, I have another example where clamdscan fails to find a virus but clamscan does. [EMAIL PROTECTED] aeiadm]# clamdscan /tmp/180334 /tmp/180334: OK --- SCAN SUMMARY --- Infected files: 0 Time: 0.033 sec (0 m 0 s) [EMAIL PROTECTED] aeiadm]# clamscan /tmp/180334 /tmp/180334: Ph

[Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread rahlquist
Hello list, I run a small mail server with clamd used to scan the incoming and outgoing email. I recently noticed that I had stopped receiving my logwatch daily digest. I looked into it and clam is stopping it claiming its phishing. Is there any way to find out what part of the email may be trigge

[Clamav-users] False Positive: Email.Phishing.RB-2646

2008-02-07 Thread rahlquist
Hello list, I run a small mail server with clamd used to scan the incomming and outgoing email. I recently noticed that I had stopped receiving my logwatch daily digest. I looked into it and clam is stopping it claiming its phishing. Is there any way to find out what part of the email may be trigg