Re: [Clamav-users] "Hits:-"

2008-04-09 Thread Gary V
> why > Apr 7 02:55:00 pumas.iingen.unam.mx /usr/sbin/amavisd[13656]: (13656-05) > Passed CLEAN, [148.243.70.5] -> < > [EMAIL PROTECTED]>, Message-ID: < > [EMAIL PROTECTED]>, mail_id: > ncLpzJIdU8Dk, Hits: -, 2417 ms > , > i mean... why is not a number? Really, this is not the amavis user's list

Re: [Clamav-users] "Hits:-"

2008-04-09 Thread Angel Camacho Villan
why Apr 7 02:55:00 pumas.iingen.unam.mx /usr/sbin/amavisd[13656]: (13656-05) Passed CLEAN, [148.243.70.5] <[EMAIL PROTECTED]> -> < [EMAIL PROTECTED]>, Message-ID: < [EMAIL PROTECTED]>, mail_id: ncLpzJIdU8Dk, Hits: -, 2417 ms , i mean... why is not a number? ___

Re: [Clamav-users] "Hits:-"

2008-04-09 Thread Brandon Perry
Do you mean what are Hits? On Wed, Apr 9, 2008 at 3:35 PM, Angel Camacho Villan < [EMAIL PROTECTED]> wrote: > hello, that means "Hits: -" in amavis.log > ___ > Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net > http://lurker.clam

[Clamav-users] "Hits:-"

2008-04-09 Thread Angel Camacho Villan
hello, that means "Hits: -" in amavis.log ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Anti Virus Engine - Compilation Problem

2008-04-09 Thread Chuck Swiger
On Apr 9, 2008, at 10:14 AM, [EMAIL PROTECTED] wrote: [ ...building ClamAV on MacOS X... ] > The configuration was also stopped by the PR28045 bug but configure > prefixed with CFLAGS='-O0' bypassed the problem. > Thanks once again for your expert help. Good to know things worked out for you; an

Re: [Clamav-users] Anti Virus Engine - Compilation Problem

2008-04-09 Thread sydz
On 8 Apr 2008 15:43:41 -0700 Chuck Swiger <[EMAIL PROTECTED]> wrote: [Take a look at the last part of config.log; it will probably indicate the problem. Normally, a Mac user would install the Xcode developer tools and would get a /usr/bin/cc which is a modified version of GCC 4.0.1 (currently).

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Dennis Peterson
James E. Pratt wrote: > >>> I can confirm too that Trojan.Downloader.JS.Agent-2 (and 1) hit > a >> load of legitimate sites. > > Hello . I ran into this " Trojan.Downloader.JS.Agent-2" issue yesterday > on our web server. When notified, the webmaster replied with "these are > coming from com

[Clamav-users] ClamAv-Milter Configuration Troubles

2008-04-09 Thread James Kosin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Everyone, I've got clamav-milter using a .sock file and would like to change it to use the IP socket address interface to clamd. Any ideas on what I have to do? If I just change clamav-milter options to use --external and remove the local socket f

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread James E. Pratt
> -Original Message- > From: [EMAIL PROTECTED] [mailto:clamav-users- > [EMAIL PROTECTED] On Behalf Of aCaB > Sent: Wednesday, April 09, 2008 11:28 AM > To: ClamAV users ML > Subject: Re: [Clamav-users] Many Javascript false - positives > > Henrik K wrote: > > On Wed, Apr 09, 2008 at 04:49:

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread aCaB
Henrik K wrote: > On Wed, Apr 09, 2008 at 04:49:17PM +0200, aCaB wrote: >> Henrik K wrote: >>> On Wed, Apr 09, 2008 at 03:53:16PM +0200, aCaB wrote: Henrik K wrote: >> But I have another one, also without PUA ;-) >> http://www.beta.wetter.com/lib/js/1d7c7a52.js --> >> Trojan.Downl

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Henrik K
On Wed, Apr 09, 2008 at 04:49:17PM +0200, aCaB wrote: > Henrik K wrote: > > On Wed, Apr 09, 2008 at 03:53:16PM +0200, aCaB wrote: > >> Henrik K wrote: > But I have another one, also without PUA ;-) > http://www.beta.wetter.com/lib/js/1d7c7a52.js --> > Trojan.Downloader.JS.Agent-2 >

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread aCaB
Henrik K wrote: > On Wed, Apr 09, 2008 at 03:53:16PM +0200, aCaB wrote: >> Henrik K wrote: But I have another one, also without PUA ;-) http://www.beta.wetter.com/lib/js/1d7c7a52.js --> Trojan.Downloader.JS.Agent-2 This is also a "ajax - jquery - lib" from a popular, german - w

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Henrik K
On Wed, Apr 09, 2008 at 03:53:16PM +0200, aCaB wrote: > Henrik K wrote: > >> But I have another one, also without PUA ;-) > >> http://www.beta.wetter.com/lib/js/1d7c7a52.js --> > >> Trojan.Downloader.JS.Agent-2 > >> This is also a "ajax - jquery - lib" from a popular, german - website. > > > > I

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread aCaB
Henrik K wrote: >> But I have another one, also without PUA ;-) >> http://www.beta.wetter.com/lib/js/1d7c7a52.js --> >> Trojan.Downloader.JS.Agent-2 >> This is also a "ajax - jquery - lib" from a popular, german - website. > > I can confirm too that Trojan.Downloader.JS.Agent-2 (and 1) hit a load

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Arnaud Jacques
Le mercredi 9 avril 2008 15:26, Alexander Siebnich a écrit : > Arnaud Jacques schrieb: > > At the moment, PUA should not be used in production environment. > > See FAQ (http://www.clamav.org/support/faq/) for details. > > Thank you for this advice. I just wondered that this problem only > occured s

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Henrik K
On Wed, Apr 09, 2008 at 03:26:48PM +0200, Alexander Siebnich wrote: > Arnaud Jacques schrieb: > > At the moment, PUA should not be used in production environment. > > See FAQ (http://www.clamav.org/support/faq/) for details. > > > Thank you for this advice. I just wondered that this problem only

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Alexander Siebnich
Arnaud Jacques schrieb: > At the moment, PUA should not be used in production environment. > See FAQ (http://www.clamav.org/support/faq/) for details. > Thank you for this advice. I just wondered that this problem only occured since the last main.cvd - update, but we can change this. But I hav

Re: [Clamav-users] Many Javascript false - positives

2008-04-09 Thread Arnaud Jacques
Hi, Le mercredi 9 avril 2008 14:26, Alexander Siebnich a écrit : > Hello, > > we use clamav to scan http - traffic. Since the main.cvd - update we > have many false - positives with widespread used js - libs. > > For example: > http://www.cisco.com/swa/j/global.js > --> PUA.JS.Packed > > http://i.d

[Clamav-users] Many Javascript false - positives

2008-04-09 Thread Alexander Siebnich
Hello, we use clamav to scan http - traffic. Since the main.cvd - update we have many false - positives with widespread used js - libs. For example: http://www.cisco.com/swa/j/global.js --> PUA.JS.Packed http://i.dell.com/images/global/js/lib/jquery-1.2.2.js --> PUA.JS.Packed http://www.hp.com