Re: [clamav-users] daily database broken again

2011-02-28 Thread Christoph Moench-Tegeder
Hi, just an idea for those insisting on running old versions: After some simple tests I believe it's possible to get your own "database check" even on versions older than 0.96.x (4?). Have freshclam update the signatures into a testing directory, not the "real" clamav database dir (that's what Dat

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Jerry wrote: > On Mon, 28 Feb 2011 11:29:17 -0500 Nathan Gibbs > articulated: > >> A flag day now and then (0.94.x DB issue) is OK, but not as a regularly >> scheduled event. Whats the point of putting the latest Clamav on a system >> when the Dev team is going to break it in a matter of months

Re: [clamav-users] daily database broken again

2011-02-28 Thread Dennis Peterson
On 2/28/11 7:30 AM, Török Edwin wrote: Maybe we should tag all our new signatures with 0.96.4+ (ldb, bytecode, and ndb at least)? Of course that means that 0.95 would be even less effective at detecting malware than it already is (no VI/IDB/CBC support there), but apparently people running 0.95

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Török Edwin wrote: > On 2011-02-28 18:29, Nathan Gibbs wrote: >> * Török Edwin wrote: >>> but apparently people running 0.95 care more about clamd "working" than >>> actually detecting malware. >>> >> 0.95 working equals more protection than 0.95 not working. > > Fair enough. > Would it be OK wi

Re: [clamav-users] daily database broken again

2011-02-28 Thread Bowie Bailey
On 2/28/2011 12:17 PM, Royce Williams wrote: > On Mon, Feb 28, 2011 at 7:39 AM, Bowie Bailey wrote: >> ClamAV 0.96 was released in April of 2010. How much time do you need to >> schedule an upgrade? If my servers were still running an old version a >> month after an update, I would consider it a

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
On Mon, Feb 28, 2011 at 7:39 AM, Bowie Bailey wrote: > ClamAV 0.96 was released in April of 2010.  How much time do you need to > schedule an upgrade?  If my servers were still running an old version a > month after an update, I would consider it a serious problem.  AV > programs need to be kept u

Re: [clamav-users] daily database broken again

2011-02-28 Thread Török Edwin
On 2011-02-28 18:29, Nathan Gibbs wrote: > * Török Edwin wrote: >> but apparently people running 0.95 care more about clamd "working" than >> actually detecting malware. >> > > 0.95 working equals more protection than 0.95 not working. Fair enough. Would it be OK with you if 0.95 only got .hdb(MD

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jerry
On Mon, 28 Feb 2011 11:29:17 -0500 Nathan Gibbs articulated: > * Török Edwin wrote: > > but apparently people running 0.95 care more about clamd "working" > > than actually detecting malware. > > > > 0.95 working equals more protection than 0.95 not working. > > I will concede that its not the

Re: [clamav-users] daily database broken again

2011-02-28 Thread Bowie Bailey
On 2/28/2011 10:03 AM, Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? > > In other words, the entry is tagged with "min 0.98.2", and if you're > running 0.98.1, it ignores it, but com

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Török Edwin wrote: > but apparently people running 0.95 care more about clamd "working" than > actually detecting malware. > 0.95 working equals more protection than 0.95 not working. I will concede that its not the best solution, but its better than no solution. My opinion on reasonable back

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matus UHLAR - fantomas
> On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams > wrote: > > For future-proofing purposes, would it be feasible to enable > > optionally tagging a signature with its minimum supported ClamAV > > version? On 28.02.11 16:14, Tomasz Kojm wrote: > Such mechanisms are already available in ClamAV.

Re: [clamav-users] daily database broken again

2011-02-28 Thread Török Edwin
On 2011-02-28 17:14, Tomasz Kojm wrote: > On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams > wrote: >> For future-proofing purposes, would it be feasible to enable >> optionally tagging a signature with its minimum supported ClamAV >> version? > > Such mechanisms are already available in ClamAV.

Re: [clamav-users] daily database broken again

2011-02-28 Thread Tomasz Kojm
On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? Such mechanisms are already available in ClamAV. Also freshclam >= 0.96.2 will never install a data

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matt Hayes
On 2/28/2011 9:51 AM, Webstar VN Admin wrote: > I got problem too:( *It has happened twice this month.* > > Mon Feb 28 22:50:16 2011 -> SelfCheck: Database modification detected. > Forcing reload. > Mon Feb 28 22:50:16 2011 -> Reading databases from /var/lib/clamav > Mon Feb 28 22:50:16 2011 -> ER

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
For future-proofing purposes, would it be feasible to enable optionally tagging a signature with its minimum supported ClamAV version? In other words, the entry is tagged with "min 0.98.2", and if you're running 0.98.1, it ignores it, but complains loudly so that people know that they're running l

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
On Mon, Feb 28, 2011 at 6:03 AM, Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? Given that this would represent a db change that has its own compatibility issues, would it be feasib

Re: [clamav-users] daily database broken again

2011-02-28 Thread Webstar VN Admin
I got problem too:( *It has happened twice this month.* Mon Feb 28 22:50:16 2011 -> SelfCheck: Database modification detected. Forcing reload. Mon Feb 28 22:50:16 2011 -> Reading databases from /var/lib/clamav Mon Feb 28 22:50:16 2011 -> ERROR: reload db failed: Malformed database Mon Feb 28 22:50

Re: [clamav-users] daily database broken again

2011-02-28 Thread Antoine Gallavardin
yep Works for me too Thanks again antoine - Mail Original - De: "Ben Lambrey" À: clamav-users@lists.clamav.net Envoyé: Lundi 28 Février 2011 15h11:47 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: [clamav-users] daily database broken again On Monday, Februa

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
12790 should fix it. J On Feb 28, 2011, at 8:44 AM, Matthias Hank wrote: > Hi, > > On Mon, Feb 28, 2011 at 08:36:54AM -0500, Joel Esler wrote: > >> Try now, Edwin just released a new version and he says that it works on his >> side. > > I tried > > File: daily.cld > Build time: 28 Feb 2011

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matthias Hank
Hi, On Mon, Feb 28, 2011 at 08:36:54AM -0500, Joel Esler wrote: > Try now, Edwin just released a new version and he says that it works on his > side. I tried File: daily.cld Build time: 28 Feb 2011 07:57 -0500 Version: 12789 with ClamAV 0.95.3 Didn't work :-( LibClamAV Error: Incorrect offs

Re: [clamav-users] daily database broken again

2011-02-28 Thread Ben Lambrey
On Monday, February 28, 2011 01:43:43 pm Matus UHLAR - fantomas wrote: > Hello, > > today I got this error again: > > LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature > type-1 LibClamAV Error: Problem parsing database at line 116 > LibClamAV Error: Can't load > /tmp/clama

Re: [clamav-users] daily database broken again

2011-02-28 Thread Ben Lambrey
On Monday, February 28, 2011 02:36:54 pm Joel Esler wrote: > Jesse, > > Try now, Edwin just released a new version and he says that it works on his > side. > Joel, This seems to work. Thank you -- b...@lambrey.net ___ Help us build a comprehensive C

Re: [clamav-users] daily database broken again

2011-02-28 Thread Andreas Cammin
Hello folks, this also seems to apply on our customer machines. Andreas Am 28.02.2011 14:36, schrieb Joel Esler: Jesse, Try now, Edwin just released a new version and he says that it works on his side. -- - Securepoint Gm

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
Joel, That update appears to work well on my end. Thanks! "Joel Esler" said: > Jesse, > > Try now, Edwin just released a new version and he says that it works on his > side. > > Thanks. > > Joel > > On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > >> # freshclam >> ClamAV update process

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
Jesse, Try now, Edwin just released a new version and he says that it works on his side. Thanks. Joel On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > # freshclam > ClamAV update process started at Mon Feb 28 08:04:06 2011 > WARNING: Your ClamAV installation is OUTDATED! > WARNING: Local ve

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
We are working on it now. We'll let the list know when it's ready. J On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > # freshclam > ClamAV update process started at Mon Feb 28 08:04:06 2011 > WARNING: Your ClamAV installation is OUTDATED! > WARNING: Local version: 0.95.3 Recommended version:

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
# freshclam ClamAV update process started at Mon Feb 28 08:04:06 2011 WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.95.3 Recommended version: 0.97 DON'T PANIC! Read http://www.clamav.net/support/faq main.cld is up to date (version: 53, sigs: 846214, f-level: 53, builder:

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
As Edwin said the last time "this" happened. Unfortunately, we support the current version and one back with the ClamAV DB (Edwin correct me if I am wrong at any point), and with the rollout of 0.97, that means that 0.97 and 0.96 are the supported versions. New detection features are rolled ou

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
Yes, ClamAV 0.95.3/12788/Mon Feb 28 06:55:40 2011 "Joel Esler" said: > Jesse, are you also running 0.95? > > > On Feb 28, 2011, at 7:46 AM, Jesse Klint wrote: > >> We are seeing a similar issue here. A forced freshclam pulls down the same >> corrupted update. Patiently waiting for a fix

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
Jesse, are you also running 0.95? On Feb 28, 2011, at 7:46 AM, Jesse Klint wrote: > We are seeing a similar issue here. A forced freshclam pulls down the same > corrupted update. Patiently waiting for a fix > > "Matus UHLAR - fantomas" said: > >> Hello, >> >> today I got this error agai

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
We are seeing a similar issue here. A forced freshclam pulls down the same corrupted update. Patiently waiting for a fix "Matus UHLAR - fantomas" said: > Hello, > > today I got this error again: > > LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature > type-1 > LibC

[clamav-users] daily database broken again

2011-02-28 Thread Matus UHLAR - fantomas
Hello, today I got this error again: LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature type-1 LibClamAV Error: Problem parsing database at line 116 LibClamAV Error: Can't load /tmp/clamav-61d6e84956044ced93fd4ddfd974c4ca/daily.ldb: Malformed database Yes, this server run