[EMAIL PROTECTED] wrote:
Sam DeForest wrote:
<[EMAIL PROTECTED]>, uid 508) with qmail-scanner-1.25-st-qms
(clamdscan: 0.88/1235. spamassassin: 3.0.0. perlscan: 1.25-st-qms.
Clear:RC:0(220.175.180.80):SA:0(-1.2/5.0):
...
So, in my estimation, it looks to be that clamdscan is not using the
la
Bill Shupp wrote:
Trog wrote:
On Mon, 2006-01-09 at 15:37 -0800, Bill Shupp wrote:
First, I would check the filesystem type of /tmp (or whatever you are
using). Make sure it is not sync'ed or journalling.
Next, I would investigate the pthreads libraries. If your system has
more than one to choo
that in mind, is there a document, or a group of documents
out there that I can read (gimme RFCs, non-official standards, ANYTHING)
that describe the plethora of standards ClamAV uses or plans to use
in the future? Or maybe just a general list of what's currently out
there?
Thank
D
users that has this problem though.
Tomasz Kojm has correctly asked me to get more information, but I haven't
been able to yet. I'm going to see if a CVS snapshot or 0.75.1 clears up
the problem on Monday.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 26
p cpt->strarg
>> $7 = 0x805a0c0 "80.168.70.183"
>>
>> Since the call to gethostbyname has a valid argument, I'm guessing
>> there's probably some memory corruption causing this crash.
>
> Thank you for reporting this bug. gethostbyname() is no
ake it into 75.1?
Or do I need to patch manually when I upgrade from
73 -> 75.1 on Monday?
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
-
because I've seen reports of viruses slipping
through 0.74 and 0.75.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
-
> It's fixed in CVS. Please update.
In my opinion a bug that major should warrant a new release, if only 0.74a
or 0.74.1. Asking people to update to CVS to fix a serious bug doesn't make
sense.
That would be like the linux kernel developers asking everyone to update to
CVS to fix c
My experience
with Bacula on FreeBSD leads me to suspect a pthreads (libc_r) bug, but it
may very well just be a ClamAV bug. I'm personally doing everything I can
to track this down, but it's slow going.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 //
seem to be the only person consistently experiencing this
problem.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
K. Shantanu wrote:
> On Mon, May 17, 2004 at 08:45:26AM -0400, Jesse Guardiani wrote:
>
>> It does if you delete the socket file from your run script. But you need
>> to upgrade to 0.70 anyway, and I imagine that you'll start having
>> problems with clamd hanging
. Perhaps you
should take a look at monit.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is spo
uot;Virus name contains above"
selected, then click on "Netsky.AB Vendor: Fsecure" and the resulting
page doesn't even mention Worm.Somefool.AB.
I'm impressed by the information that *is* there though. If you can tweak
it until it spits out more relevant information then
Jason Haar wrote:
> On Wed, May 05, 2004 at 02:15:29PM -0400, Jesse Guardiani wrote:
>> past 0.70-rc a month or two ago. 0.70 (upgraded just yesterday) does the
>> same thing. I'm running FreeBSD 4.8-RELEASE + daemontools. I don't see
>> the seg fault, but my
reeBSD 4.8-RELEASE + daemontools. I don't see the seg
fault, but my clamd is hanging every 5 or 10 minutes and I'm forced to use monit
to test the socket and restart it if it's not working. This bug is really crimping my
style. :)
--
Jess
#x27;s making long multi-meg mail
transfers near impossible. The up side is that
my mail is virus free. :) But I'd really love
to see a solution to this problem.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cl
han welcome.
Looks nice. I'm a little confused about the "top 10 viruses last month"
and "... last week" text though. What about this month and this week?
You got some source code I can download for that? :)
--
Jesse Guardiani, Systems Administrator
WingNET Internet Servi
st like we submit virus samples now, then what harm would it
do to allow the door to swing both ways? And the benefit is obvious: Some windows
guy got infected with NetSky? Hmmm... I wonder what Clam calls that? Let's find
out...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Serv
Jesse Guardiani wrote:
> Antony Stone wrote:
>
> [...]
>
>> I think the best we'll ever achieve is a cross-reference database.
>
> Yes please.
>
> What needs to be done to get this online? Who needs access to what?
> Public reference submissions
Antony Stone wrote:
[...]
> I think the best we'll ever achieve is a cross-reference database.
Yes please.
What needs to be done to get this online? Who needs access to what?
Public reference submissions, or core maintainers?
I think we desperately need this functionality.
-
hat does that do?
>
> It's in CVS, an option for clamd. From the combo you run, am I right in
> assuming you don't use clamd at all, but only clamdscan??? In that case
> then you don't run clamd as a daemon and FixStaleSocket really becomes
> irrelevant in your case.
As
Jesse Guardiani wrote:
> Jesse Guardiani wrote:
>
> [...]
>
>> I'm going to try uncommenting LogFileUnlock in clamav.conf.
>
>
> That didn't work. Help! I'm at a loss...
Hmmm... Reverting to 0.70-rc seems to solve the problem
--
Jesse Guardia
Jesse Guardiani wrote:
[...]
> I'm going to try uncommenting LogFileUnlock in clamav.conf.
That didn't work. Help! I'm at a loss...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423
Jesse Guardiani wrote:
[...]
> I'll look into the locking thing. I'm also configuring a debug
> version so I can run ktrace on it. More in a bit. I can't go home
> until this silly thing is fixed...
Hmmm... I'm leaning toward a locking problem with the log file
at
Todd Lyons wrote:
> On Fri, 2004-04-02 at 14:09, Jesse Guardiani wrote:
>
>> Mar 31 didn't work for me. See other email on the subject.
>
> You can download the tarball that I used for mine at
> http://downloads.mrball.net/SpamAssassin/clamav-0.70pre2.tar.gz
>
>
Jesse Guardiani wrote:
> Robert Blayzor wrote:
>
>> On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote:
>>
>>> Howdy list,
>>>
>>>
>>> # uname -a
>>> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-
Todd Lyons wrote:
> On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote:
>
>> > I there any chance this bug has been fixed in the
>> > latest CVS?
>> There must be some special email out there that triggers
>> this behavior. I've had to kill -9 the clamd
Robert Blayzor wrote:
> On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote:
>
>> Howdy list,
>>
>>
>> # uname -a
>> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri Apr
>> 11
>> 12:59:08 EDT
Todd Lyons wrote:
> On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote:
>
>> > I there any chance this bug has been fixed in the
>> > latest CVS?
>> There must be some special email out there that triggers
>> this behavior. I've had to kill -9 the clamd
Odhiambo Washington wrote:
> * Jesse Guardiani <[EMAIL PROTECTED]> [20040402 20:12]: wrote:
>> Howdy list,
>>
>> We've been running CVS version devel-20040325
>> for about a week with great success, but just
>> this morning it locked up. I tried:
>
Jesse Guardiani wrote:
[...]
> I there any chance this bug has been fixed in the
> latest CVS?
There must be some special email out there that triggers
this behavior. I've had to kill -9 the clamd process 3
times since my first message about this problem to this
list. If it happens
anOnExec
ClamukoIncludePath /home
ClamukoMaxFileSize 1M
ClamukoScanArchive
I there any chance this bug has been fixed in the
latest CVS?
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
42
th the GPL.
I still don't understand what the big deal is with calling external
unpacking programs. Security risk? How? qmail-scanner does it. And
you don't have to enable it by default. And all of these silly rar
memory leak and licensing issues would evaporate.
--
Jesse Guardiani, Systems
ys: "grep: unknown directories method"?
I don't know. Please read `man grep` to find out.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
Mike Cathey wrote:
> Jesse,
>
> On Fri, 2004-03-26 at 10:46, Jesse Guardiani wrote:
>> :) Why not if it can already performing actions on the above
>> items?
>
> Clamav is a virus scanner. Features like that belong in whatever rips
> apart messages for Clamav t
Jesse Guardiani wrote:
[...]
> I see similar symptoms when my clamd (0.70-rc) process chokes on a
> message it doesn't like. The clamd process starts eating between 50%
> and 100% CPU and gobbling up RAM.
Quick note: The CVS version from 2004/03/26 fixes this problem for
pwd-1
1 Worm.Bagle.Gen-1
1 W32.Magistr.B5
1 W32.Magistr.B
1 Trojan.URLspoof.gen.2
1 SCR - (ATTACHMENT)
1 PIF - (ATTACHMENT)
1 LNK - (ATTACHMENT)
1 Exploit.HTML.Bagle.Gen-7-eml
1 Exploit.HTML.Bagle.Gen-3-eml
1 Disallowed breakage found in header name - potential virus
--
Jes
had 'com' extension!!
>
> Better i block the 'com' extension itself,atleast reducing the load on
> CLAM :))
Which scanner are you using? qmail-scanner scans viruses FIRST, then blocks
extensions based on policy. This change was made between 1.20-rc2 and 1.20-rc3
if I reme
Nigel Horne wrote:
> On Thursday 25 Mar 2004 10:05 pm, Jesse Guardiani wrote:
>
>> Is there any way to make clamd log the structure of
>> a message and it's attachments? BinHex, MIME, plain-text,
>> ZIP, RAR, BZIP, GZIP, OLE2, etc...?
>
> I don't consid
you see above.
Is your clamd process even running? Or did it die? I don't see it
listed above.
Also, what's your `uname -a`?
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.
also.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tut
h FreeBSD's process vs. threading memory limits though.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email
an.
What is your MaxThreads value set to in clamav.conf?
How about MaxConnectionQueueLength?
It's possible that ClamAV already has MaxThreads number of threads running
and your 4k message is sitting in the connection queue waiting for a thread
to become available so it can run.
--
Jesse Guardiani,
D seems to be OLE2.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is sponsored by:
Tomasz Kojm wrote:
> On Mon, 22 Mar 2004 15:54:18 -0500
> Jesse Guardiani <[EMAIL PROTECTED]> wrote:
>
>> Any ideas on how to avoid this in the future? I'm running with
>> ScanArchive and ScanMail (because I want the binhex feature on).
>
> The problem m
virtually every machine known to man. That's my experience with C anyway.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
r scanners and it would make it real
> easy to find.
I'd like to add a quick: Me too
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (
amd. That's what I would do. :)
> It's a release candidate, not a recognized stable
> code. Just a thought.
I'm aware of that. Besides this stress testing bug I haven't
had any problems with it. The upgrade was well worth the risk
for the new features.
--
Jesse Guardiani,
Tomasz Kojm wrote:
> On Mon, 22 Mar 2004 15:54:18 -0500
> Jesse Guardiani <[EMAIL PROTECTED]> wrote:
>
>> Any ideas on how to avoid this in the future? I'm running with
>> ScanArchive and ScanMail (because I want the binhex feature on).
>
> The problem m
that recently.
>
> -Nigel
No, it's strictly text and just a LOT of characters. I can send it zipped
or a small sample if anyone is interested. It has a lot of repeating
characters, so it aught to compress rather well.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services
rchive
and ScanMail (because I want the binhex feature on).
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Ne
r per hour in a
particular geographic region or (ideally) state/country.
Of course, I wrote the above thinking of a client/server solution, but a sort of
ad-hoc computer-computer network might work too. That would certainly change the trust
system a good bit. Hmmm... something to think about.
I&#
ClamAV polling system with select ClamAV users around the world
so we could see a visual map of how these things spread and where
the damage or infection is greatest.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK
McAfee up front, but McAfee is quite a bit cheaper than Sophos for the long
haul.
ClamAV is by far the biggest bang for your buck on an Open Source mail server.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v)
McDonald, Dan wrote:
> -Original Message-
> From: Jesse Guardiani
>>Is there a database anywhere that lists all the viruses
>>that forge addresses?
>
> There may be, but can you react quickly to a new one?
If one exists, then yes, I can. I'm a programmer
Howdy list,
Is there a database anywhere that lists all the viruses
that forge addresses?
I'd like to prevent my server from sending out false
notification messages.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
42
--
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
>
le as possible.
The only thing I forgot to do was protect my email address
in the /usr/local/clamav/supervise/clamd/run script.
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingne
he clamav user to the FreeBSD password
database. You'll probably have to use different syntax/commands under a different
OS.
In addition, I've made a slight change at the bottom of the howto to better
indicate the end of the /usr/local/clamav/supervise/clamd/run file.
NOTE: I run this EXAC
1-000393DC8E02%40oakley.nyi.net%3E
For a complete clamd/daemontools install solution.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
ently. But ClamAV's current virus def for Worm.Gibe.F
seems to be faulty because it only catches about 50% of my Gibe-F viruses...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559
]
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http
testing...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This sf.net email is sponsored by:ThinkGeek
Welcome to
I have tested
most of my submissions by using the web based CGI submission
tool too:
http://www.gietl.com/test-clamav/
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423
Is the virusdb list functioning?
I'm not getting any updates from it.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingne
Daniel Wiberg wrote:
> Jesse Guardiani wrote:
>
>>Darek M wrote:
>>
>>
>>>Hey guys, new member here, go easy on me.
>>>
>>>2. clamd dies on me on signal 11 (core dump). Is this a common issue?
>>>If so, is there a fix? Regardless o
#x27;s scanning
> our email.
I'm not 100% sure, but I _think_ it allows clamd to scan within MIME mail and
such. I just turned it on because it seemed like a good idea. I'm not sure if
it helps when using qmail-scanner or not. :)
--
J
md under DJB's daemontools package. My clamdctl script (after the fashion
of apachectl and qmailctl) properly handles the socket file cleanup and even
makes sure that if clamd dies it will be immediately restarted.
Check out this thread:
http://news.gmane.org/onethread.php?group=gma
don't need to PING my clamd daemon, so I've never bothered.
>
> Thats all for now.
>
> Thanks guys
> Malcolm
> PS - I'm very impressed with clam over all. Thumbs up to the folks who
> put it together and keep it running.
I'll second that. I
On Friday 12 September 2003 11:05, Odhiambo Washington wrote:
> * Jesse Guardiani <[EMAIL PROTECTED]> [20030912 17:48]: wrote:
>
> Hi Jesse,
>
> > clamd from clamav-0.60 dies ocassionally on me too. I run FreeBSD
> > 4.8-RELEASE on a Dell PowerEdge 4300. I have the
the safest, most stable distribution
I can find.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
Thi
ch will monitor
the script and restart it if it dies.
I have attached a plain text step-by-step HOWTO guide, roughly after the
style of Life With Qmail. It assumes that you already have clamd installed
and running properly.
Let me know if you like it.
--
Jesse Guardiani, Systems Administrator
W
g emails, for that matter) through to a test box running ClamAV from
CVS. Might put a bit more load on the production server, but it shouldn't break
it's back, unless it's already struggling.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Clev
this memory pre-allocated, or is it allocated
on demand?
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This
ts to a minimum.
My manager has also expressed interest in "selective" virus protection,
perhaps on a per domain or even a per user basis.
Anyway, I'd love to see what you've got. Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // C
x27;d go with what I know. But now I'm starting to
wonder if a daemonized scanner might give me better
performance.
Looking forward to hearing everyone's thoughts on the matter!
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 3
76 matches
Mail list logo
