Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-05 Thread The Disc Shop
The Disc Shop wrote: [EMAIL PROTECTED] wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-03 Thread Tomasz Papszun
On Thu, 01 Dec 2005 at 17:26:24 -0800, [EMAIL PROTECTED] wrote: > Matthew.van.Eerde wrote: > > The Disc Shop wrote: > >> [EMAIL PROTECTED] wrote: > >> clamdscan --config-file=/usr/local/etc/clamd.conf abc > > Hmm... why is there a --config-file switch for clamdscan? E.g. one can run more than

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread John W. Baxter
On 12/1/05 5:40 PM, "The Disc Shop" <[EMAIL PROTECTED]> wrote: > Ah okay, my bad. Misread the man clamd, thought QUIT was an option. You are far from the only one (although I was trying PING, not QUIT). Yes, it is certainly possible to read the man page correctly, but I didn't. --John (one of

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs rea

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
Matthew.van.Eerde wrote: > The Disc Shop wrote: >> [EMAIL PROTECTED] wrote: >> clamdscan --config-file=/usr/local/etc/clamd.conf abc Hmm... why is there a --config-file switch for clamdscan? I see it's in the man page... does it really work for all options? -- Matthew.van.Eerde (at) hbinc.com

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
The Disc Shop wrote: > [EMAIL PROTECTED] wrote: > clamdscan --config-file=/usr/local/etc/clamd.conf abc > /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs read access to it. > srwxrwxrwx

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: Kill all your freshclam and clamd processes. Put your .pid and socket files in a place that clamd can write. clamd starts as root, but if it needs to SIGHUP, it needs to recreate the .pid files and reinitialize the socket as clamd. I've done all this now but i

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread James Kosin
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 The Disc Shop wrote: > > > [EMAIL PROTECTED] wrote: > >>> >>> OK, so: clamscan is detecting the virus, but clamdscan is not? >>> Please confirm. >>> >>> When was the last time you restarted clamd? Perhaps it's not >>> reloading the virus databas

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread Matthew.van.Eerde
The Disc Shop wrote: > [EMAIL PROTECTED] wrote: > clamdscan --config-file=/usr/local/etc/clamd.conf abc > /var/spool/virtual/thediscshop.com.au/accounts: Access denied. ERROR Well, that's easy. The clamd user doesn't have permission to the file you're trying to scan. Make sure to give the clamd

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread The Disc Shop
[EMAIL PROTECTED] wrote: OK, so: clamscan is detecting the virus, but clamdscan is not? Please confirm. When was the last time you restarted clamd? Perhaps it's not reloading the virus database whenever freshclam downloads a new update. Can you post your freshclam config as well (withou

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread Matthew.van.Eerde
The Disc Shop wrote: > The Disc Shop wrote: >> >> LogFile /tmp/clamd.log >> >> PidFile /var/run/clamd.pid >> >> DatabaseDirectory /var/lib/clamav >> >> LocalSocket /tmp/clamd >> >> FixStaleSocket >> >> User clamav >> >> AllowSupplementaryGroups >> >> ScanArchive >> > > Anyone got any idea

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Peterson
The Disc Shop said: >>> >> This is the info from my clamd.conf >> >> LogFile /tmp/clamd.log >> PidFile /var/run/clamd.pid >> DatabaseDirectory /var/lib/clamav >> LocalSocket /tmp/clamd >> FixStaleSocket >> User clamav >> AllowSupplementaryGroups >> ScanArchive >> > > Anyone got any ideas on this?

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Noel Jones
At 10:46 PM 11/29/2005, The Disc Shop wrote: Anyone got any ideas on this? find / -name daily.cvd | xargs ls -l ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
The Disc Shop wrote: Dennis Skinner wrote: The Disc Shop wrote: Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Freshclam is apparently working since you have the latest defs, so

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Dennis Skinner wrote: The Disc Shop wrote: Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Freshclam is apparently working since you have the latest defs, so I'd say your clamd.conf

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Peterson
> > > > Then post your config. There is something wrong in it. > > > the clamd.conf or freshclam.conf or both. And should i post it in the > body or as an attachment > Do this to get the important bits of the files. It ignores comments and empty lines: egrep -v "#|^$" clamd.conf >/tmp/clam_cnf

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Skinner
The Disc Shop wrote: Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Freshclam is apparently working since you have the latest defs, so I'd say your clamd.conf would be more useful (clamd

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Dennis Skinner wrote: The Disc Shop wrote: Does clamscan recognize it? clamscan doesn't use the settings in either clamd.conf or freshclam.conf... but clamscan does accept a --database=/var/db/clamav command-line option. Yes, clamscan recognizes it. I ran clamscan on the spool file for o

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Skinner
The Disc Shop wrote: Does clamscan recognize it? clamscan doesn't use the settings in either clamd.conf or freshclam.conf... but clamscan does accept a --database=/var/db/clamav command-line option. Yes, clamscan recognizes it. I ran clamscan on the spool file for one of our email addresses.

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
[EMAIL PROTECTED] wrote: The Disc Shop wrote: It's not being recognised on my email server either. # sigtool -l|grep -i Sober.U Worm.Sober.U # clamd -V ClamAV 0.87.1/1198/Tue Nov 29 20:05:20 2005 I have checked that the Database Directory is correct in both the clamd.conf and freshclam.co

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Matthew.van.Eerde
The Disc Shop wrote: > Richard Hirner wrote: > >> At 28.11.2005, 21:38 +0100, Richard Hirner wrote: >> >>> [Sober.U not recognised] >>> >> >> The problem was that the signature directory of the FreeBSD port has >> changed from /usr/local/share/clamav to /var/db/clamav, but I didn't >> update th

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Richard Hirner wrote: At 28.11.2005, 21:38 +0100, Richard Hirner wrote: [Sober.U not recognised] The problem was that the signature directory of the FreeBSD port has changed from /usr/local/share/clamav to /var/db/clamav, but I didn't update the freshclam.conf so freshclam download

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Freddie Cash
On November 29, 2005 09:37 am, Richard Hirner wrote: > At 28.11.2005, 21:38 +0100, Richard Hirner wrote: > >[Sober.U not recognised] > The problem was that the signature directory of the FreeBSD port has > changed from /usr/local/share/clamav to /var/db/clamav, but I didn't > update the freshclam.

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Richard Hirner
At 28.11.2005, 21:38 +0100, Richard Hirner wrote: >[Sober.U not recognised] The problem was that the signature directory of the FreeBSD port has changed from /usr/local/share/clamav to /var/db/clamav, but I didn't update the freshclam.conf so freshclam downloaded the sigs to the old directory whic

[Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Richard Hirner
At 21 Nov 2005 13:24:43 -0900, Pete 'Wolfy' wrote: > I'm running clamav-milter 0.87 from ClamAV 0.87.1 with sendmail 8.13.5, with > a database that is fully up-to-date (main.cvd version 34, daily.cvd version > 1182), but for some reason this setup is not catching Worm.Sober.U, and > we're getting s

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread Pete 'Wolfy' Hanson
> > DisableDefaultScanOptions > DetectBrokenExecutables > No change in behavior with those opts -- Pete Hanson http://www.well.com/user/wolfy http://www.fotolog.net/wolfy ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread Tomasz Kojm
On Mon, 21 Nov 2005 17:11:25 -0600 René Berber <[EMAIL PROTECTED]> wrote: > Fix it by editing /etc/clamd.conf, make sure that the following are set: > > DisableDefaultScanOptions Oh, no. Please do not enable this directive. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\.

[Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread René Berber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pete 'Wolfy' Hanson wrote: [snip] > Running clamscan --detect-broken finds the message, and generates no errors, > but clamav-milter does not find the message when it comes in. clamd.logshows: The key is that "clamscan --detect-broken" is not the defa