Re: [Clamav-users] unclear whitelist syntax clamav-milter an logging ClamAV 0.95.1

2009-04-30 Thread Robert Schetterer
Robert Schetterer schrieb: > Hi all > i have ClamAV 0.95.1 > Whitelist /etc/clamav-milter-whitelist > in /etc/clamav-milter.conf > > in Whitelist /etc/clamav-milter-whitelist > i have > i.e > "From:r...@example.server.com" > is this the right syntax ? ( i think i read it changed) > i dont get a

Re: [Clamav-users] Question about Phish heuristic

2009-04-30 Thread MrC
On 4/30/2009 12:28 AM, Török Edwin wrote: > That submission id is another sample you submitted on April 17th that > matches Email.Phishing.DblDom-59, > and it doesn't have anything about sears or harrahs-marketing inside it. > Thanks for the response. Oh, OK. I can't tell from the mailing l

Re: [Clamav-users] [ClamAV-users] HELP!unrecognized option `--pidfile=/var/run/clamav-milter/clamav-milter.pid'

2009-04-30 Thread Gomes, Rich
Does anyone have a fix for this? -Original Message- From: Gomes, Rich Sent: Tuesday, April 28, 2009 10:40 AM To: ClamAV users ML Subject: RE: [Clamav-users] [ClamAV-users] HELP!unrecognized option `--pidfile=/var/run/clamav-milter/clamav-milter.pid' Thanks, this is a new install of OS a

[Clamav-users] unclear whitelist syntax clamav-milter an logging ClamAV 0.95.1

2009-04-30 Thread Robert Schetterer
Hi all i have ClamAV 0.95.1 Whitelist /etc/clamav-milter-whitelist in /etc/clamav-milter.conf in Whitelist /etc/clamav-milter-whitelist i have i.e "From:r...@example.server.com" is this the right syntax ? ( i think i read it changed) i dont get any entry that it wasnt scanned in the verbose cla

Re: [Clamav-users] Scan flow of signature files?

2009-04-30 Thread Jason Bertoch
> -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Matt Forbis > Sent: Thursday, April 30, 2009 9:44 AM > To: clamav-users@lists.clamav.net > Subject: [Clamav-users] Scan flow of signature files? > > > The reas

[Clamav-users] Scan flow of signature files?

2009-04-30 Thread Matt Forbis
Hello, Could someone please explain the exact flow of how each type of signature file is used when scanning a file? I'm guessing that when a file is scanned, it is first checked against the Md5 signatures within the HDB files. If that passes, it is then checked against the Md5's of the FP

Re: [Clamav-users] Question about Phish heuristic

2009-04-30 Thread Tom Shaw
At 4:03 PM -0700 4/29/09, MrC wrote: >I submitted what I considered to be a FP on > >Phishing.Heuristics.Email.SpoofedDomain > >Submission-ID: 7705854 >Sender: Me >Submission notes: not a false positive >Added: No > >which was not considered a FP. The code below is what trigger

Re: [Clamav-users] "Virus Infected" Message for recipient

2009-04-30 Thread James Kosin
Dan Metcalf wrote: >> - Original Message - >> From: "Michelle Konzack" >> To: >> Sent: Wednesday, April 29, 2009 2:48 PM >> Subject: Re: [Clamav-users] "Virus Infected" Message for recipient > > >>> I also came across the same issue. Of course I Reject the messages, but >>> for >>> m

Re: [Clamav-users] "Virus Infected" Message for recipient

2009-04-30 Thread aCaB
martinnitram wrote: > At clamav 0.94, it can config clamav-milter that send a "Virus Infected" > notify email to recipient when a virus scanned. But from 0.95.1, the milter > only had 'Blackhole' option that direct drop the virus email without any > user notification like 0.94. Is that had any opti

Re: [Clamav-users] Question about Phish heuristic

2009-04-30 Thread Dennis Peterson
Török Edwin wrote: > On 2009-04-30 02:03, MrC wrote: >> I submitted what I considered to be a FP on >> >>Phishing.Heuristics.Email.SpoofedDomain >> >>Submission-ID: 7705854 >> > > That submission id is another sample you submitted on April 17th that > matches Email.Phishing.DblDom-59,

Re: [Clamav-users] Question about Phish heuristic

2009-04-30 Thread Török Edwin
On 2009-04-30 02:03, MrC wrote: > I submitted what I considered to be a FP on > >Phishing.Heuristics.Email.SpoofedDomain > >Submission-ID: 7705854 > That submission id is another sample you submitted on April 17th that matches Email.Phishing.DblDom-59, and it doesn't have anything abou