Re: [Clamav-users] bytecode Rev 16 DoS

2010-05-11 Thread John W. Baxter
On our test machine, in US Pacific Daylight time (-0700). ... Tue May 11 05:17:32 2010 -> bytecode.cld is up to date (version: 15, sigs: 2, f-level: 51, builder: nervous) ... Tue May 11 06:17:53 2010 -> WARNING: getfile: Error while reading database from db.us.clamav.net (IP: 199.184.215.2): Opera

Re: [Clamav-users] Clamav-Milter crashes continously

2009-12-23 Thread John W. Baxter
On 12/23/09 9:57 AM, "Jim Preston" wrote: > > On Dec 19, 2009, at 9:22 AM, Jim Preston wrote: > >> Török Edwin wrote: >>> On 2009-12-19 00:56, Jim Preston wrote: >>> Could I have a bad setting in the freshclam.conf? >>> >>> Why should the milter be affected by freshclam? Its only p

Re: [Clamav-users] WARNING: Suspicious recipient address blocked

2008-04-15 Thread John W. Baxter
On 4/15/08 5:09 PM, "John Rudd" <[EMAIL PROTECTED]> wrote: > Tilman Schmidt wrote: > >> So why am I dissecting that list like this? Just to show that blocking >> or not blocking certain unusal characters in mail addresses is indeed a >> policy decision which should not be forced by a piece of sof

Re: [Clamav-users] Getting line numbers

2007-10-04 Thread John W. Baxter
On 10/3/07 10:45 AM, "Dennis Peterson" <[EMAIL PROTECTED]> wrote: > Karsten Bräckelmann wrote: >> On Tue, 2007-10-02 at 10:24 -0700, Dennis Peterson wrote: >>> Can anyone offer a reason why the OP found a virus in the mbox file but not >>> in the >>> split out maildir messages? That kind of incon

Re: [Clamav-users] false positive of Email.FreeGame on MySQL DB

2007-10-03 Thread John W. Baxter
On 10/3/07 7:26 AM, "Joao S Veiga" <[EMAIL PROTECTED]> wrote: > "Pagamento" (payment) is a VERY common subject in Portuguese, and having a > numeric > link anywhere after that in your mailbox or in the same email causes the false > positive. That signature is WAY too prone of false positives! So

Re: [Clamav-users] Possible problem with Phishing.Heuristics.Email.SpoofedDomain daily sigs 4054

2007-08-27 Thread John W. Baxter
Problem seems not to be a ClamAV problem, but ours. Sorry for the noise. On 8/24/07 2:12 PM, "John W. Baxter" <[EMAIL PROTECTED]> wrote: > Daily sigs: 4054; main 44. ClamAv 0.91.2-1 > > Installed on CentOS-4.5 from Dag's packages. Freshly updated via the >

Re: [Clamav-users] Possible problem with Phishing.Heuristics.Email.SpoofedDomain daily sigs 4054

2007-08-27 Thread John W. Baxter
On 8/24/07 2:12 PM, "John W. Baxter" <[EMAIL PROTECTED]> wrote: > Daily sigs: 4054; main 44. ClamAv 0.91.2-1 > > Installed on CentOS-4.5 from Dag's packages. Freshly updated via the > packages from the ancient 0.90-2 (also Dag's). (of course > For t

Re: [Clamav-users] Question About Version 0.91.2

2007-08-27 Thread John W. Baxter
On 8/27/07 10:49 AM, "Kaplan, Andrew H." <[EMAIL PROTECTED]> wrote: > I am prepared to upgrade our servers to version 0.91.2 of ClamAV, but I read > several e-mails that mentioned > > operational problems with that version. Have these issues been resolved, or > should I wait for the next version

[Clamav-users] Possible problem with Phishing.Heuristics.Email.SpoofedDomain daily sigs 4054

2007-08-24 Thread John W. Baxter
Daily sigs: 4054; main 44. ClamAv 0.91.2-1 Installed on CentOS-4.5 from Dag's packages. Freshly updated via the packages from the ancient 0.90-2 (also Dag's). Called via pyclamav (rebuilt to matching libclamav) in our own code. One sample: what looks like a proper Netflix shipping notice, whi

Re: [Clamav-users] What's broken?

2007-04-10 Thread John W. Baxter
On 4/10/07 7:20 PM, "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote: > Don Drake wrote: >> I'm seeing the same thing. Even my ClamWin puked. >> >> -Don >> >> On 4/10/07, Dennis Peterson <[EMAIL PROTECTED]> wrote: >> >>> Has the ClamAV backbone died? >>> >>> > It might be related with main

Re: [Clamav-users] How to make ClamAV scan incoming email received by qmail on Plesk

2007-03-12 Thread John W. Baxter
On 3/11/07 11:02 PM, "Dennis Peterson" <[EMAIL PROTECTED]> wrote: > And I would never assume mail I receive has ever been scanned before, > but that's not what is implied in what I said, is it? If we both scan a > message one of us is redundant. I'm going to scan anyway, but hopefully > because yo

Re: [Clamav-users] Freshclam not updating

2007-03-08 Thread John W. Baxter
On 3/8/07 8:43 AM, "Daniel J McDonald" <[EMAIL PROTECTED]> wrote: > You will probably need to read through the whole freshclam.conf and > clamd.conf file to make those changes. I learned a couple of emacs commands I hadn't found in 12 years of using emacs, in the course of comparing our running c

Re: [Clamav-users] Can't open directory /var/db/clamav/daily.inc

2007-03-02 Thread John W. Baxter
On 3/2/07 10:10 AM, "Zivago Lee" <[EMAIL PROTECTED]> wrote: > >> On 3/2/07 9:48 AM, "Noel Jones" <[EMAIL PROTECTED]> wrote: >> >>> Upgrade to the just-released clamav-0.90.1 which fixes this and a few >>> other problems. >> >> Thanks. When dag updates (or this weekend, whichever happens second

Re: [Clamav-users] Can't open directory /var/db/clamav/daily.inc

2007-03-02 Thread John W. Baxter
On 3/2/07 9:48 AM, "Noel Jones" <[EMAIL PROTECTED]> wrote: > Upgrade to the just-released clamav-0.90.1 which fixes this and a few > other problems. Thanks. When dag updates (or this weekend, whichever happens second) I'll do so. --John ___ Help u

Re: [Clamav-users] clamav vs norton

2007-03-02 Thread John W. Baxter
On 3/2/07 8:25 AM, "Sean Pinegar" <[EMAIL PROTECTED]> wrote: > I trusted clamav for a long time but ran across an interesting problem today. > I received an e-mail from a friend that included a powerpoint. I opened the > powerpoint in linux and wine flagged it as a virus (not sure how wine knew >

Re: [Clamav-users] can eamils from local network be excluded from scanning at MTA

2007-03-02 Thread John W. Baxter
On 3/2/07 12:57 AM, "Zbigniew Szalbot" <[EMAIL PROTECTED]> wrote: > The subject says it all - I wonder if it is possible to exclude certain > local IPs from being scanned by clamd when they connect to my MTA? As you now know, it's possible, since you've done it. Whether it's a good idea is anoth

Re: [Clamav-users] can eamils from local network be excluded from scanning at MTA

2007-03-02 Thread John W. Baxter
On 3/2/07 4:00 AM, "Zbigniew Szalbot" <[EMAIL PROTECTED]> wrote: > Hello, > >> Of course ... but this is certainly not a clamav configuration >> thing. Certainly you do have some piece of software to make your MTA >> interacts with clamav. Whitelisting your local emails should be done on >> this

Re: [Clamav-users] Can't open directory /var/db/clamav/daily.inc

2007-03-02 Thread John W. Baxter
On 3/1/07 10:55 AM, "Gerard Seibert" <[EMAIL PROTECTED]> wrote: > On Thursday March 01, 2007 at 12:45:20 (PM) John W. Baxter wrote: > >> The way our system operates, we learned of the problem well after the 700 >> permissions were set up, when I restar

Re: [Clamav-users] Can't open directory /var/db/clamav/daily.inc

2007-03-01 Thread John W. Baxter
On 3/1/07 9:00 AM, "Dennis Peterson" <[EMAIL PROTECTED]> wrote: > Tomasz Kojm wrote: >> On Thu, 01 Mar 2007 11:09:49 -0500 >> Craig Green <[EMAIL PROTECTED]> wrote: >> >>> The failure happens when the perms on the daily.inc directory >>> mysteriously become 700 and thus deny group reads. Since t

Re: [Clamav-users] DB Update email before actual update available?

2006-12-28 Thread John W. Baxter
On 12/26/06 9:16 AM, "Dennis Peterson" <[EMAIL PROTECTED]> wrote: > We found different solutions. But in nearly 30 years of doing this every > day I can tell you I've never had a cron daemon fail I saw one human-induced (the boss, not me) crond failure on BSDi many years ago. The boss accidental

Re: [Clamav-users] Memory leak on x86_64!?

2006-12-22 Thread John W. Baxter
On 12/22/06 6:31 AM, "Stephan Brauss" <[EMAIL PROTECTED]> wrote: > When I scan a 3.5GB file > (in fact it is a VMWARE vmdk-file and not an archive) I don't know the format of a VMWare file. Is it useful to scan it (or are the contents enough unlike what a scanner knows about that problems are un

Re: [Clamav-users] DB Update email before actual update available?

2006-12-21 Thread John W. Baxter
On 12/21/06 10:28 AM, "Mark" <[EMAIL PROTECTED]> wrote: > Heck, > even starting freshclam per cron, IMHO, is a hugely expensive affair > (repeated startup/initialization cost). Just running a small daemonized > freshclam (about 5M), which periodically does an extremely light-weight > DNS query, is

Re: [Clamav-users] Out of memory, cannot allocate memory

2006-01-23 Thread John W. Baxter
On 1/23/06 12:25 PM, "Todd Lyons" <[EMAIL PROTECTED]> wrote: > Originally the datacenter was Exodus, then it was bought by Cable & > Wireless, then it was bought by Savvis. I've been around email long enough that "Exodus" sends cold shivers up and down my spine. Oh, wait...maybe that's due to th

Re: [Clamav-users] OT: American date format (was: [EMAIL PROTECTED] undetected)

2006-01-19 Thread John W. Baxter
On 1/19/06 7:41 AM, "JT Justman" <[EMAIL PROTECTED]> wrote: > Probably we should all start using ISO-8601 -MM-DD format since > otherwise half the dates in the year are ambiguous. Call it a friendly > compromise. Which is what we started using in-house several months ago. What's wrong with

Re: [Clamav-users] Squirriel Mail clamav scanner

2006-01-09 Thread John W. Baxter
On 1/9/06 11:18 AM, "John Jolet" <[EMAIL PROTECTED]> wrote: > I guess the point here (and I agree with it) is the concept of > defense in depth. Even if my server is scanning, why shouldn't my > client go ahead and scan? just think how hard viruses would have to > work if EVERY process that touc

Re: [Clamav-users] Scanning outgoing mail? - was: cpu utilization suddenly over 90% all the time

2006-01-09 Thread John W. Baxter
On 1/9/06 7:08 AM, "John Kielkopf" wrote: > For those that scan outgoing, how much has your outgoing filter actually > caught? We caught about 4 infections of Hybris ("Snow White", HaHa) last month. In at least two cases (I didn't learn the resolution of the other two), it was from a house gues

Re: [Clamav-users] RE: Report infected mail to the user

2006-01-06 Thread John W. Baxter
On 1/6/06 11:40 AM, "Chuck Swiger" <[EMAIL PROTECTED]> wrote: > I agree with this almost entirely. You should absolutely try to 5xx refuse > known-malicious email traffic, or if you have to accept it, silently file it > away in a quarantine area for a knowledgeable human to review questionable >

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread John W. Baxter
On 12/1/05 5:40 PM, "The Disc Shop" <[EMAIL PROTECTED]> wrote: > Ah okay, my bad. Misread the man clamd, thought QUIT was an option. You are far from the only one (although I was trying PING, not QUIT). Yes, it is certainly possible to read the man page correctly, but I didn't. --John (one of

Re: [Clamav-users] GMX Systematic Comparison

2004-03-29 Thread John W. Baxter
On 3/29/2004 7:12, "Sam Hart" <[EMAIL PROTECTED]> wrote: > * On 04-03-28, Tomasz Kojm wrote: >>> Now they say that Symantec and Sophos caught 100% of all the viruses, >>> and ClamAV only got 54%! >> >> At least Symantec has full access to all WildList.org virus samples >> because that "independen