Re: [Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Tom Samplonius
- Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem <[EMAIL PROTECTED]> wrote: > Is their any way to tell Clamav to look at a file > before it is considered a Virus? > > I got a call from a customer who said that Zip files > are getting intercepted by clamav and are

Re: [Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Chuck Swiger
On Dec 5, 2006, at 1:36 PM, Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem wrote: Is their any way to tell Clamav to look at a file before it is considered a Virus? I got a call from a customer who said that Zip files are getting intercepted by clamav and are defaul

[Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem
Is their any way to tell Clamav to look at a file before it is considered a Virus? I got a call from a customer who said that Zip files are getting intercepted by clamav and are defaulting them as a virus. ___ Help us build a comprehensive ClamAV guide:

Re: [Clamav-users] zip files and clamav-milter

2005-09-23 Thread Nick Golder
On 2005-09-21 11:50 -0700, [EMAIL PROTECTED] wrote: > clamd is used by clamav-milter iff --external is used. > > If --external is NOT used, clamav-milter does its own scanning via > libclamav. In which case, the question of virus definition update > notification becomes important. How/when does

Re: [Clamav-users] zip files and clamav-milter

2005-09-23 Thread Cevher
Hi All, Zip files and exe files with the Worm.Bagz.D payload passing through the clamav-milter. I've saved the attachments from the infected messages and tried to resend them. In this case clamav-milter recognize them. On the other hand, if I forward or redirect the infected message, it passes the

RE: [Clamav-users] zip files and clamav-milter

2005-09-21 Thread Matthew.van.Eerde
Nick Golder wrote: > On 2005-09-21 09:51 -0700, [EMAIL PROTECTED] wrote: >> Are you using --external? > > Currenlty I am using LocalSocket. Using --external didn't make a > difference. Did you manually scan with clamscan or clamdscan? Try both ways. > Is clamd, via LocalSocket, being used by c

Re: [Clamav-users] zip files and clamav-milter

2005-09-21 Thread Nick Golder
On 2005-09-21 09:51 -0700, [EMAIL PROTECTED] wrote: > Are you using --external? Currenlty I am using LocalSocket. Using --external didn't make a difference. > > How does clamav-milter know when new virus definitions are available? > I assume freshclam doesn't notify clamav-milter threads. Is c

RE: [Clamav-users] zip files and clamav-milter

2005-09-21 Thread Matthew.van.Eerde
Nick Golder wrote: > I am consistently seeing zip files with the Worm.Bagle.Gen-* payload > getting through the clamav-milter (clamav-0.87). The milter is at > least partially working: > X-Virus-Scanned: ClamAV version 0.87, clamav-milter version 0.87 on > xxx.xxx.xxx X-Virus-Status: Clean > Are

[Clamav-users] zip files and clamav-milter

2005-09-21 Thread Nick Golder
I am consistently seeing zip files with the Worm.Bagle.Gen-* payload getting through the clamav-milter (clamav-0.87). The milter is at least partially working: X-Virus-Scanned: ClamAV version 0.87, clamav-milter version 0.87 on xxx.xxx.xxx X-Virus-Status: Clean Manually scanning the zip archive r

[Clamav-users] Zip files not being scanned

2005-05-29 Thread Frode Egeland
Hi all, I'm not 100% sure this is the correct list to ask this, but as the problem relates to ClamAV, I hope someone will have the answer for me. I've got a mail filter server set up, running postfix, amavisd-new, SpamAssassin and ClamAV. This morning, it was found that a worm had somehow gotte

Re: [Clamav-users] Zip files.

2004-02-26 Thread Peter McCreath
--- russ <[EMAIL PROTECTED]> wrote: > On Thu, 2004-02-26 at 04:41, Peter McCreath wrote: > > > Thanks, but yes i run freshclam via a cron job. > > The strange thing is that running clamdscan on a > mesg > > will detect the eicar zip test, but clamd still > lets > > this through. > > Did you un-

Re: [Clamav-users] Zip files.

2004-02-26 Thread russ
On Thu, 2004-02-26 at 04:41, Peter McCreath wrote: > Thanks, but yes i run freshclam via a cron job. > The strange thing is that running clamdscan on a mesg > will detect the eicar zip test, but clamd still lets > this through. Did you un-comment "scanmail" in the clamav.conf? Post your conf f

Re: [Clamav-users] Zip files.

2004-02-26 Thread Peter McCreath
--- russ <[EMAIL PROTECTED]> wrote: > On Wed, 2004-02-25 at 11:40, Peter McCreath wrote: > > > Any pointers would be greatly appreciated, > > Did you run freshclam as soon as you saw the few get > past? > Two zip file got past me, then I ran freshclam, and > start catching > Somefool.B and th

Re: [Clamav-users] Zip files.

2004-02-25 Thread russ
On Wed, 2004-02-25 at 11:40, Peter McCreath wrote: > Any pointers would be greatly appreciated, Did you run freshclam as soon as you saw the few get past? Two zip file got past me, then I ran freshclam, and start catching Somefool.B and they where all zip files. Just a thought, -- Russel Ol

Re: [Clamav-users] Zip files.

2004-02-25 Thread Derek J. Balling
On Feb 25, 2004, at 11:40 AM, Peter McCreath wrote: I'm still having problems with zip files containing viruses getting past Clamav, I'm running Clamav 0.67 , with Mimedefang 2.39. I've enabled Streamsavetodisk and Scanarchive in my clamav.conf, but all to no avail. Any pointers would be greatly ap

[Clamav-users] Zip files.

2004-02-25 Thread Peter McCreath
Hello All, I'm still having problems with zip files containing viruses getting past Clamav, I'm running Clamav 0.67 , with Mimedefang 2.39. I've enabled Streamsavetodisk and Scanarchive in my clamav.conf, but all to no avail. Any pointers would be greatly appreciated, Regards Peter __

RE: [clamav-users] zip files nto being scanned

2003-06-27 Thread Salvador Aguilar Huerta
MAIL PROTECTED] > -Mensaje original- > De: _Chris McKeever_ [mailto:[EMAIL PROTECTED] > Enviado el: Viernes, 27 de Junio de 2003 10:18 a.m. > Para: '[EMAIL PROTECTED]' > Asunto: RE: [clamav-users] zip files nto being scanned > > > Looks like it is catchi

Re: [clamav-users] zip files nto being scanned

2003-06-27 Thread Nicholas Chua
> Looks like it is catching it today! > Thanks If you like, sign up [EMAIL PROTECTED] maillist. Whenever a new sig is added, you will be informed. - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [E

RE: [clamav-users] zip files nto being scanned

2003-06-27 Thread _Chris McKeever_
> Sent: Friday, June 27, 2003 9:45 AM > To: '[EMAIL PROTECTED]' > Subject: Re: [clamav-users] zip files nto being scanned > > > On Fri, 27 Jun 2003, _Chris McKeever_ wrote: > > > Is there a way I can check that clam is scanning zips alright? > > In the t

Re: [clamav-users] zip files nto being scanned

2003-06-27 Thread Jeffrey Goldberg
On Fri, 27 Jun 2003, _Chris McKeever_ wrote: > Is there a way I can check that clam is scanning zips alright? In the test directory in the distribution there is a file called test1. Try zipping that and mailing it through your system. When I do that clamav does catch it. > maybe this one (Sobig

[clamav-users] zip files nto being scanned

2003-06-27 Thread _Chris McKeever_
I think the below is slipping by my clam/qmail scan. It comes in a zip file. Is there a way I can check that clam is scanning zips alright? maybe this one isnt supported by clam yet? NAV output: Sender of the infected attachment: [EMAIL PROTECTED] Recipient of the infected attachment: Michael