Re: [Clamav-users] LibClamAV Error: WARNING: not scanned; untested big block size - please report

2004-11-24 Thread Shawn Tayler
On 24-Nov-2004 12:07:05 CET [EMAIL PROTECTED] exclaimed: > > I attached a file with this problem. > I also tried to open it and I saw that it's impossible. I think > the > problem comes from that. > > Thanks, > Irina > > (See attached file: relance.zip) > Interesting, Both the o

[Clamav-users] Building 0.80rc3 with SSL built from source

2004-10-01 Thread Shawn Tayler
Hello, I've been looking through the mail list archives and can't seem to locate the answer to this problem. I have been trying to build Clamav from source. I have only been successful on one machine. All the machines are Slackware, either 9, 9.1, or 10.0. The one machine where it builds is th

Re: [Clamav-users] password-protected Worm.Bagle.H

2004-03-10 Thread Shawn Tayler
On Tue, 2 Mar 2004 04:14:52 -0800 (PST) [EMAIL PROTECTED] exclaimed: > > > Worm.Bagle.H found in unzipped file. It\'s impossible > > to create signature of encrypted zip file. > > This new infection method is likely to drive us nuts. This is the > password-less workaround I've come up with and

[Clamav-users] Large tar and tar.gz/tgz files

2004-03-06 Thread Shawn Tayler
Hi Guys, I been perusing the users manual pdf and the docs and can't find, probably because I am missing it, how I can scan some REALL large tar, tar.gz, and tgz files, ie 2-18 Gigs worth. just scanning with clamscan gives a "tonyc.tar: Value too large for defined data type" error. Can I cat the

Re: [Clamav-users] Worm.Bagle.F-zippwd-5..

2004-03-03 Thread Shawn Tayler
On Wed, 3 Mar 2004 16:19:02 +0100 "Diego d'Ambra" <[EMAIL PROTECTED]> exclaimed: > The Worm.Bagle.F-zippwd-x detects e-mails infected with password > protected zip files and it also detects some of the later variants. > > Best regards, > Diego d'Ambra I find it interesting that the msgs with the

Re: [Clamav-users] Password-protected .zip file viruses

2004-03-03 Thread Shawn Tayler
There used to be a utility, way back in my OS/2 days, I think it was called Stripper or something like that. It removed the HTML crap from files leaving only the plain text... Shawn On Wed, 03 Mar 2004 07:43:35 + Chris Meadors <[EMAIL PROTECTED]> exclaimed: > Good point. That should take

Re: [Clamav-users] password-protected Worm.Bagle.H

2004-03-02 Thread Shawn Tayler
On Tue, 2 Mar 2004 17:07:53 +0100 Erik Corry <[EMAIL PROTECTED]> exclaimed: > The question is how much of a problem it really is. Are users > really that dumb? > > What I'm wondering is whether the encrypted version of the > virus can be created by the unencrypted version, or whether the > encry

Re: [Clamav-users] PROBLEMS

2004-02-19 Thread Shawn Tayler
I have Slack current here and it built just fine. Take a look at the dependancies list as well as run swaret against -current and get the updates... YMMV... Shawn On Wed, 18 Feb 2004 16:36:32 +0200 (EET) "Adrian Gurbina (main)" <[EMAIL PROTECTED]> exclaimed: > I GOT slackware 9.1 and i try to

Re: [Clamav-users] SCO.a

2004-02-01 Thread Shawn Tayler
On Sat, 31 Jan 2004 08:37:09 - "Nigel Horne" <[EMAIL PROTECTED]> exclaimed: > Already in CVS. It's not a fix though, it's a new feature. Of course it is! Shawn --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Op

Re: [Clamav-users] Handling Quarantined Virii

2004-02-01 Thread Shawn Tayler
This brings up a side question. What does ClamAV do the files that it places in quarantine? Are they modified in any way? Shawn On Fri, 30 Jan 2004 17:03:05 -0500 Jason Frisvold <[EMAIL PROTECTED]> exclaimed: > Hi all, > > How does everyone handle the clamav quarantine? I'm running cl

Re: [Clamav-users] Worm.SCO.A

2004-01-31 Thread Shawn Tayler
Notice, the "Sexy" name gets the media attention though Shawn On Thu, 29 Jan 2004 12:15:17 +0800 "Fritz Mesedilla" <[EMAIL PROTECTED]> exclaimed: > They are the same. AV vendors just have their way of naming the same > virus. > > We call it Worm.SCO.A. McAfee calls it MyDoom. Symantec call

Re: [Clamav-users] SCO.a

2004-01-30 Thread Shawn Tayler
Ok Nigel, You were absolutely right, the msgs I was refering to were all bounces, my mistake. Is there a fix in the works for this? Shawn On Tue, 27 Jan 2004 16:59:08 + Nigel Horne <[EMAIL PROTECTED]> exclaimed: > On Tuesday 27 Jan 2004 2:31 pm, Shawn Tayler wrote: > > N

Re: [Clamav-users] SCO.a

2004-01-29 Thread Shawn Tayler
On Wed, 28 Jan 2004 17:34:33 + Nigel Horne <[EMAIL PROTECTED]> exclaimed: > This comment has been obseleted by the changes to today's CVS snapshot. > > > > Shawn > > > > -Nigel Excellent Thanks --- The SF.Net email is sponsored by Ec

Re: [Clamav-users] SCO.a

2004-01-28 Thread Shawn Tayler
I am curious, It appears that I have missed something very important in my Clamav setup, 0.65, in that I have several examples of Maildir files that contain a known, detectable virus, that will not show as conatining such unless the file is converted to binary from mime. I use the --mbox and -

Re: [Clamav-users] SCO.a

2004-01-27 Thread Shawn Tayler
Nigel, I have several examples of this. Even with older virii. Would you be interested in them as well? Shawn On Tue, 27 Jan 2004 08:52:58 + Nigel Horne <[EMAIL PROTECTED]> exclaimed: > On Tuesday 27 Jan 2004 3:11 am, McKeever Chris wrote: > > > Any suggestions? It finds other virii f

Re: [Clamav-users] (Slightly OT) Worm Hybris.D in WIndows Partition

2004-01-23 Thread Shawn Tayler
Usually the best option is to simply delete, or archive (probably the better choice) the infected file, then restore the original from the source, Windows CAB or the application CD, that it came from. HTH, Shawn On Fri, 23 Jan 2004 18:42:17 +0530 N S Srikanth <[EMAIL PROTECTED]> exclaimed: >

[Clamav-users] Clamav and Mime

2004-01-20 Thread Shawn Tayler
Hi Guys, I spent some time in the list archives looking for an answer on this and I may of missed it. Has the issue of Clamav missing known and detected (when in binary form anyway) virii when they are attached to an email (mime encoded), mbox or Maildir, been solved? Just curious. Shawn --