Re: [clamav-users] daily database broken again

2011-03-10 Thread Török Edwin
On 2011-03-10 00:03, Mark wrote: > I'm still running 0.96. No errors, but I did notice my clamd process shot > up in memory to about 5x its normal size (it has "Loaded 915868 > signatures.") What's up with that? Did a whole lot of new sigs get added > overnight? That is quite a normal number of si

Re: [clamav-users] daily database broken again

2011-03-09 Thread Mark
al Message- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of Joel Esler Sent: maandag 28 februari 2011 14:00 To: ClamAV users ML Subject: Re: [clamav-users] daily database broken again As Edwin said the last time "this" happened.

Re: [clamav-users] daily database broken again

2011-03-05 Thread Jim Preston
On 03/05/2011 03:11 PM, Dennis Peterson wrote: On 3/5/11 8:36 AM, Jim Preston wrote: You have missed the point, my system does serve my needs to the extent that upgrading the OS is not worth the benefit till now. A major cause is the lack of a clean upgrade path from the early FC versions.

Re: [clamav-users] daily database broken again

2011-03-05 Thread Jim Preston
On 03/05/2011 02:51 PM, Steve Holdoway wrote: I think that you're so outside anything that could remotely be called Fedora to become irrelevant. FC7 is way out of support, and all Fedoras are only designed to be short term desktop os's anyway. So all of your support is manual, and you've lost

Re: [clamav-users] daily database broken again

2011-03-05 Thread Peter Bonivart
On Sat, Mar 5, 2011 at 11:11 PM, Dennis Peterson wrote: > Though there is no free VM tool for Mac - Fusion is dirt cheap. VirtualBox is free and runs on Mac, it can even host Mac vm's. /peter ___ Help us build a comprehensive ClamAV guide: visit http:/

Re: [clamav-users] daily database broken again

2011-03-05 Thread Dennis Peterson
On 3/5/11 8:36 AM, Jim Preston wrote: You have missed the point, my system does serve my needs to the extent that upgrading the OS is not worth the benefit till now. A major cause is the lack of a clean upgrade path from the early FC versions. The recommended method was a clean install. Since v

Re: [clamav-users] daily database broken again

2011-03-05 Thread Steve Holdoway
On Sat, 2011-03-05 at 09:36 -0700, Jim Preston wrote: > On 03/04/2011 04:31 PM, Jerry wrote: > > On Fri, 04 Mar 2011 12:05:57 -0700 > > Jim Preston articulated: > > > > A system should serve your needs, not its. It sounds to me like you > > have become a slave to yours. Any properly maintained sys

Re: [clamav-users] daily database broken again

2011-03-05 Thread Jim Preston
On 03/04/2011 04:31 PM, Jerry wrote: On Fri, 04 Mar 2011 12:05:57 -0700 Jim Preston articulated: A system should serve your needs, not its. It sounds to me like you have become a slave to yours. Any properly maintained system needs some degree of personalizing; ie, configuration. However, if yo

Re: [clamav-users] daily database broken again

2011-03-04 Thread Jerry
On Fri, 04 Mar 2011 12:05:57 -0700 Jim Preston articulated: > > > On 02/28/2011 08:56 PM, Nathan Gibbs wrote: > > It personally wouldn't matter to me as I am running 0.97 on my > > servers. So why am I fussing? > > > > Last April when 0.96 was rolled out, some of out servers couldn't > > be upg

Re: [clamav-users] daily database broken again

2011-03-04 Thread Jim Preston
On 02/28/2011 09:39 AM, Bowie Bailey wrote: On 2/28/2011 10:03 AM, Royce Williams wrote: For future-proofing purposes, would it be feasible to enable optionally tagging a signature with its minimum supported ClamAV version? In other words, the entry is tagged with "min 0.98.2", and if you're

Re: [clamav-users] daily database broken again

2011-03-04 Thread Jim Preston
On 02/28/2011 08:56 PM, Nathan Gibbs wrote: It personally wouldn't matter to me as I am running 0.97 on my servers. So why am I fussing? Last April when 0.96 was rolled out, some of out servers couldn't be upgraded. Fortunately, by August the ClamAV Team fixed whatever was broken in the firs

Re: [clamav-users] daily database broken again

2011-03-04 Thread Jim Preston
On 03/01/2011 12:59 AM, Simon Hobson wrote: Thats an unsafe question to answer. No matter how its answered, you shoot yourself in the foot. Its like "Have you quit beating your wife?" Yes - You were beating her. No - You are beating her. Yes, that is why you say you have just reduced the b

Re: [clamav-users] daily database broken again

2011-03-01 Thread Jim Preston
On 02/28/2011 09:29 AM, Nathan Gibbs wrote: * Török Edwin wrote: but apparently people running 0.95 care more about clamd "working" than actually detecting malware. 0.95 working equals more protection than 0.95 not working. I will concede that its not the best solution, but its better than

Re: [clamav-users] daily database broken again

2011-03-01 Thread Nathan Gibbs
* Christoph Moench-Tegeder wrote: > Hi, > > just an idea for those insisting on running old versions: After some > simple tests I believe it's possible to get your own "database check" > even on versions older than 0.96.x (4?). Have freshclam update the > signatures into a testing directory, not t

Re: [clamav-users] daily database broken again

2011-03-01 Thread Tonix (Antonio Nati)
Il 01/03/2011 08:59, Simon Hobson ha scritto: I too am grateful to the ClamAV team - but I also sometimes think their attitude to users "lacks sensitivity" at times. I agree. Upgrading may depends on a lot of steps, which may be not easy to repeat sometimes, and which may be delayed to bet

Re: [clamav-users] daily database broken again

2011-03-01 Thread Simon Hobson
Nathan Gibbs wrote: > I am not aware of the team issuing a new major version number that they > then break in a few months with a new major version update. 0.95.x was the latest version less than a year ago. To me, it seems a little soon to EOL it. > At some point the end user has to a

Re: [clamav-users] daily database broken again

2011-02-28 Thread Christoph Moench-Tegeder
Hi, just an idea for those insisting on running old versions: After some simple tests I believe it's possible to get your own "database check" even on versions older than 0.96.x (4?). Have freshclam update the signatures into a testing directory, not the "real" clamav database dir (that's what Dat

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Jerry wrote: > On Mon, 28 Feb 2011 11:29:17 -0500 Nathan Gibbs > articulated: > >> A flag day now and then (0.94.x DB issue) is OK, but not as a regularly >> scheduled event. Whats the point of putting the latest Clamav on a system >> when the Dev team is going to break it in a matter of months

Re: [clamav-users] daily database broken again

2011-02-28 Thread Dennis Peterson
On 2/28/11 7:30 AM, Török Edwin wrote: Maybe we should tag all our new signatures with 0.96.4+ (ldb, bytecode, and ndb at least)? Of course that means that 0.95 would be even less effective at detecting malware than it already is (no VI/IDB/CBC support there), but apparently people running 0.95

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Török Edwin wrote: > On 2011-02-28 18:29, Nathan Gibbs wrote: >> * Török Edwin wrote: >>> but apparently people running 0.95 care more about clamd "working" than >>> actually detecting malware. >>> >> 0.95 working equals more protection than 0.95 not working. > > Fair enough. > Would it be OK wi

Re: [clamav-users] daily database broken again

2011-02-28 Thread Bowie Bailey
On 2/28/2011 12:17 PM, Royce Williams wrote: > On Mon, Feb 28, 2011 at 7:39 AM, Bowie Bailey wrote: >> ClamAV 0.96 was released in April of 2010. How much time do you need to >> schedule an upgrade? If my servers were still running an old version a >> month after an update, I would consider it a

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
On Mon, Feb 28, 2011 at 7:39 AM, Bowie Bailey wrote: > ClamAV 0.96 was released in April of 2010.  How much time do you need to > schedule an upgrade?  If my servers were still running an old version a > month after an update, I would consider it a serious problem.  AV > programs need to be kept u

Re: [clamav-users] daily database broken again

2011-02-28 Thread Török Edwin
On 2011-02-28 18:29, Nathan Gibbs wrote: > * Török Edwin wrote: >> but apparently people running 0.95 care more about clamd "working" than >> actually detecting malware. >> > > 0.95 working equals more protection than 0.95 not working. Fair enough. Would it be OK with you if 0.95 only got .hdb(MD

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jerry
On Mon, 28 Feb 2011 11:29:17 -0500 Nathan Gibbs articulated: > * Török Edwin wrote: > > but apparently people running 0.95 care more about clamd "working" > > than actually detecting malware. > > > > 0.95 working equals more protection than 0.95 not working. > > I will concede that its not the

Re: [clamav-users] daily database broken again

2011-02-28 Thread Bowie Bailey
On 2/28/2011 10:03 AM, Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? > > In other words, the entry is tagged with "min 0.98.2", and if you're > running 0.98.1, it ignores it, but com

Re: [clamav-users] daily database broken again

2011-02-28 Thread Nathan Gibbs
* Török Edwin wrote: > but apparently people running 0.95 care more about clamd "working" than > actually detecting malware. > 0.95 working equals more protection than 0.95 not working. I will concede that its not the best solution, but its better than no solution. My opinion on reasonable back

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matus UHLAR - fantomas
> On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams > wrote: > > For future-proofing purposes, would it be feasible to enable > > optionally tagging a signature with its minimum supported ClamAV > > version? On 28.02.11 16:14, Tomasz Kojm wrote: > Such mechanisms are already available in ClamAV.

Re: [clamav-users] daily database broken again

2011-02-28 Thread Török Edwin
On 2011-02-28 17:14, Tomasz Kojm wrote: > On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams > wrote: >> For future-proofing purposes, would it be feasible to enable >> optionally tagging a signature with its minimum supported ClamAV >> version? > > Such mechanisms are already available in ClamAV.

Re: [clamav-users] daily database broken again

2011-02-28 Thread Tomasz Kojm
On Mon, 28 Feb 2011 06:03:34 -0900 Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? Such mechanisms are already available in ClamAV. Also freshclam >= 0.96.2 will never install a data

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matt Hayes
On 2/28/2011 9:51 AM, Webstar VN Admin wrote: > I got problem too:( *It has happened twice this month.* > > Mon Feb 28 22:50:16 2011 -> SelfCheck: Database modification detected. > Forcing reload. > Mon Feb 28 22:50:16 2011 -> Reading databases from /var/lib/clamav > Mon Feb 28 22:50:16 2011 -> ER

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
For future-proofing purposes, would it be feasible to enable optionally tagging a signature with its minimum supported ClamAV version? In other words, the entry is tagged with "min 0.98.2", and if you're running 0.98.1, it ignores it, but complains loudly so that people know that they're running l

Re: [clamav-users] daily database broken again

2011-02-28 Thread Royce Williams
On Mon, Feb 28, 2011 at 6:03 AM, Royce Williams wrote: > For future-proofing purposes, would it be feasible to enable > optionally tagging a signature with its minimum supported ClamAV > version? Given that this would represent a db change that has its own compatibility issues, would it be feasib

Re: [clamav-users] daily database broken again

2011-02-28 Thread Webstar VN Admin
av.net > Envoyé: Lundi 28 Février 2011 15h11:47 GMT +01:00 Amsterdam / Berlin / > Berne / Rome / Stockholm / Vienne > Objet: Re: [clamav-users] daily database broken again > > On Monday, February 28, 2011 02:36:54 pm Joel Esler wrote: > > Jesse, > > > > Try now,

Re: [clamav-users] daily database broken again

2011-02-28 Thread Antoine Gallavardin
yep Works for me too Thanks again antoine - Mail Original - De: "Ben Lambrey" À: clamav-users@lists.clamav.net Envoyé: Lundi 28 Février 2011 15h11:47 GMT +01:00 Amsterdam / Berlin / Berne / Rome / Stockholm / Vienne Objet: Re: [clamav-users] daily database broken again

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
12790 should fix it. J On Feb 28, 2011, at 8:44 AM, Matthias Hank wrote: > Hi, > > On Mon, Feb 28, 2011 at 08:36:54AM -0500, Joel Esler wrote: > >> Try now, Edwin just released a new version and he says that it works on his >> side. > > I tried > > File: daily.cld > Build time: 28 Feb 2011

Re: [clamav-users] daily database broken again

2011-02-28 Thread Matthias Hank
Hi, On Mon, Feb 28, 2011 at 08:36:54AM -0500, Joel Esler wrote: > Try now, Edwin just released a new version and he says that it works on his > side. I tried File: daily.cld Build time: 28 Feb 2011 07:57 -0500 Version: 12789 with ClamAV 0.95.3 Didn't work :-( LibClamAV Error: Incorrect offs

Re: [clamav-users] daily database broken again

2011-02-28 Thread Ben Lambrey
On Monday, February 28, 2011 01:43:43 pm Matus UHLAR - fantomas wrote: > Hello, > > today I got this error again: > > LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature > type-1 LibClamAV Error: Problem parsing database at line 116 > LibClamAV Error: Can't load > /tmp/clama

Re: [clamav-users] daily database broken again

2011-02-28 Thread Ben Lambrey
On Monday, February 28, 2011 02:36:54 pm Joel Esler wrote: > Jesse, > > Try now, Edwin just released a new version and he says that it works on his > side. > Joel, This seems to work. Thank you -- b...@lambrey.net ___ Help us build a comprehensive C

Re: [clamav-users] daily database broken again

2011-02-28 Thread Andreas Cammin
Hello folks, this also seems to apply on our customer machines. Andreas Am 28.02.2011 14:36, schrieb Joel Esler: Jesse, Try now, Edwin just released a new version and he says that it works on his side. -- - Securepoint Gm

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
Joel, That update appears to work well on my end. Thanks! "Joel Esler" said: > Jesse, > > Try now, Edwin just released a new version and he says that it works on his > side. > > Thanks. > > Joel > > On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > >> # freshclam >> ClamAV update process

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
Jesse, Try now, Edwin just released a new version and he says that it works on his side. Thanks. Joel On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > # freshclam > ClamAV update process started at Mon Feb 28 08:04:06 2011 > WARNING: Your ClamAV installation is OUTDATED! > WARNING: Local ve

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
We are working on it now. We'll let the list know when it's ready. J On Feb 28, 2011, at 8:08 AM, Jesse Klint wrote: > # freshclam > ClamAV update process started at Mon Feb 28 08:04:06 2011 > WARNING: Your ClamAV installation is OUTDATED! > WARNING: Local version: 0.95.3 Recommended version:

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
# freshclam ClamAV update process started at Mon Feb 28 08:04:06 2011 WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.95.3 Recommended version: 0.97 DON'T PANIC! Read http://www.clamav.net/support/faq main.cld is up to date (version: 53, sigs: 846214, f-level: 53, builder:

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
As Edwin said the last time "this" happened. Unfortunately, we support the current version and one back with the ClamAV DB (Edwin correct me if I am wrong at any point), and with the rollout of 0.97, that means that 0.97 and 0.96 are the supported versions. New detection features are rolled ou

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
Yes, ClamAV 0.95.3/12788/Mon Feb 28 06:55:40 2011 "Joel Esler" said: > Jesse, are you also running 0.95? > > > On Feb 28, 2011, at 7:46 AM, Jesse Klint wrote: > >> We are seeing a similar issue here. A forced freshclam pulls down the same >> corrupted update. Patiently waiting for a fix

Re: [clamav-users] daily database broken again

2011-02-28 Thread Joel Esler
Jesse, are you also running 0.95? On Feb 28, 2011, at 7:46 AM, Jesse Klint wrote: > We are seeing a similar issue here. A forced freshclam pulls down the same > corrupted update. Patiently waiting for a fix > > "Matus UHLAR - fantomas" said: > >> Hello, >> >> today I got this error agai

Re: [clamav-users] daily database broken again

2011-02-28 Thread Jesse Klint
We are seeing a similar issue here. A forced freshclam pulls down the same corrupted update. Patiently waiting for a fix "Matus UHLAR - fantomas" said: > Hello, > > today I got this error again: > > LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature > type-1 > LibC

[clamav-users] daily database broken again

2011-02-28 Thread Matus UHLAR - fantomas
Hello, today I got this error again: LibClamAV Error: Incorrect offset 'VI' in subsignature id 0 for signature type-1 LibClamAV Error: Problem parsing database at line 116 LibClamAV Error: Can't load /tmp/clamav-61d6e84956044ced93fd4ddfd974c4ca/daily.ldb: Malformed database Yes, this server run