Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Thomas Lamy
Payal Rathod wrote: Hi, I am using clamdscan with qmail in conjuction with dot-qmail files. I have in .qmail | /usr/local/bin/clamdscan -; [ $? != 1 ] || exit 99 ./Maildir/ # ps aux | grep clamd root 7967 0.0 4.2 29396 10776 ? S20:54 0:00 clamd When I send a eicar test vrus it w

Re: [Clamav-users] Listing viruses in the db?

2004-01-21 Thread Tomasz Kojm
On Tue, 20 Jan 2004 16:01:47 -0500 "Kevin Hanser" <[EMAIL PROTECTED]> wrote: > there a way to search for a particular virus? Not really important to > be able to search, as long as I can get a listing of all the viruses > that it catches I just added a new option to sigtool: with --list-sigs

Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Tomasz Kojm
On Wed, 21 Jan 2004 04:58:17 + Payal Rathod <[EMAIL PROTECTED]> wrote: > Hi, > I am using clamdscan with qmail in conjuction with dot-qmail files. > I have in .qmail > > | /usr/local/bin/clamdscan -; [ $? != 1 ] || exit 99 > ./Maildir/ > > # ps aux | grep clamd > root 7967 0.0 4.2 293

Re: [Clamav-users] Listing viruses in the db?

2004-01-21 Thread Tomasz Kojm
On Wed, 21 Jan 2004 12:27:20 +1100 Darryl Luff <[EMAIL PROTECTED]> wrote: > What's the difference between --unpack and --unpack-current? They both > > seem to do the same thing and produce identical output? --unpack extracts a selected file while --unpack-current only extracts files from the dat

Re: [Clamav-users] Listing viruses in the db?

2004-01-21 Thread Trog
Quoting jonathan soong <[EMAIL PROTECTED]>: > hmm > yes clamav does detect Bagle now, but when we first got hit with Bagle > it was undetected for about 2 hours... > (i.e. clamav virus db was about 2 hours behind our first sighting of > it). I was just wondering how to > add virus signatures to

Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Payal Rathod
On Wed, Jan 21, 2004 at 09:38:17AM +0100, Thomas Lamy wrote: > > > You need to enable at least the "ScanMail" and "ScanArchive" directives > in /usr/local/etc/clamav.conf (or whereever that file resides). I did it. Stopped clamd. Restarted it. Still no luck. Same problem. Where exactly is the pro

Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Payal Rathod
On Wed, Jan 21, 2004 at 06:52:57AM +0100, Tomasz Kojm wrote: > Take a look at contrib/trashscan and use it instead of clamdscan in > .qmail. It needs procmail, which I don't use. Also logger [???] What is wrong with calmdscan? It caught eicar properly. With regards, -Payal -- For GNU/Linux Succ

Re: [Clamav-users] ERROR: Malformed CVD header detected.

2004-01-21 Thread Abyot Asalefew
I also keep getting the same under sun solaris 8. - Original Message - From: Wouter de Vries <[EMAIL PROTECTED]> Date: Tuesday, January 20, 2004 8:32 pm Subject: [Clamav-users] ERROR: Malformed CVD header detected. > Hi, > > Just to let you know, I am receiving these errors: > > ERROR:

Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Tomasz Klim
> > You need to enable at least the "ScanMail" and "ScanArchive" directives > > in /usr/local/etc/clamav.conf (or whereever that file resides). > > I did it. Stopped clamd. Restarted it. Still no luck. Same problem. > Where exactly is the problem? I don't use "clamdscan", but in "clamscan" ther

Re: [Clamav-users] OSX build problem with 0.65

2004-01-21 Thread Nigel Horne
These changes will make clamd compile under OSX10.1. The bad news is it's rather doubtful that ClamAV supports that operating system any more. It's best to ask Tomasz to put the support back in. The good news is that this part of the code is only called in the event of a crash or through someth

[Clamav-users] Another OS X prob

2004-01-21 Thread Rod Furey
I just upgraded from 0.54 to 0.65 on an OS X 10.1.5 box and now if I run clamscan it takes 1.5 hours to run in place of about 20 mins. I had to disable the thread support to get this to make and I have no support for digital signatures (as I don't know where to find it - fink doesn't seem to have i

Re: [Clamav-users] Listing viruses in the db?

2004-01-21 Thread Everton da Silva Marques
On Wed, Jan 21, 2004 at 08:56:16AM +, Trog wrote: > > > > file says you have to send it to > > a SIGNING_SERVER?? - initially i wanted to just update our own > > signatures, before worrying about sending it > > to the clamav servers) > > All you need to do is create an old style db file with

Re: [Clamav-users] LogSyslog logs twice?

2004-01-21 Thread Tomasz Papszun
On Wed, 21 Jan 2004 at 12:51:44 +1100, Darryl Luff wrote: > Has anyone noticed that enabling the LogSyslog option causes everything > to be logged twice? Or is it just something odd on my machine (sample > below)? > > Jan 20 00:11:02 gateway clamd[19226]: Reading databases from > /var/lib/clama

[Clamav-users] Multiple stability problems on Solaris 9

2004-01-21 Thread Jon R. Kibler
Hello: In the past few days we have experienced multiple stability problems with clamav. Here is our environment: Solaris 9 (sparc) mimedefang 2.36 w/ sendmail 8.12.10 clamav 0.65 The problems appear to be two fold: 1) freshclam, run as a daemon, crashes without sending a notify. freshc

Re: [Clamav-users] finding viruses in email : please help

2004-01-21 Thread Carl Holtje
If you're using qmail, look into qmailscanner.. [http://qmail-scanner.sourceforge.net/]... build a string of virus checkers (includeing it's own built-in perl scanner) to process your mail... We use it on a system with 18000+ messages a day, running each through spamassassin and clamav without

Re: [Clamav-users] Multiple stability problems on Solaris 9

2004-01-21 Thread Alex S Moore
Hi, Jon On Wed, 21 Jan 2004 11:45:11 -0500 "Jon R. Kibler" <[EMAIL PROTECTED]> wrote: > Hello: > > In the past few days we have experienced multiple stability problems with > clamav. Here is our environment: > > Solaris 9 (sparc) > mimedefang 2.36 w/ sendmail 8.12.10 > clamav 0.65 > > The prob

Re: [Clamav-users] Multiple stability problems on Solaris 9

2004-01-21 Thread Peter Bonivart
Jon R. Kibler wrote: 1) freshclam, run as a daemon, crashes without sending a notify. freshclam appears to die anytime it finds a problem with a database update instead of just reporting the error and keep on running to try again later. Run freshclam from crontab, works like a charm.

Re: [Clamav-users] Multiple stability problems on Solaris 9

2004-01-21 Thread Fajar A. Nugraha
Jon R. Kibler wrote: Hello: In the past few days we have experienced multiple stability problems with clamav. Here is our environment: Solaris 9 (sparc) mimedefang 2.36 w/ sendmail 8.12.10 clamav 0.65 Isn't 0.65 known to have problems? I use daily snapshot (devel-20040115) and it works fine

[Clamav-users] Maildrop core dump and clamd

2004-01-21 Thread Björn Ketelaars
Hello, Since a couple of days I'm using clamd/clamdscan on an OpenBSD (snapshot/i386) machine. Clamd is started at boot time and clamdscan is being used by means of a maildrop filter... if (`/usr/local/bin/clamdscan --mbox --disable-summary --stdout - | grep -c 'FOUND'` == 1) { to "$DEFAULT/.

[Clamav-users] ClamAV instabilities

2004-01-21 Thread Marc Balmer
Hello About since the "big-virus" import of about 10'000 viruses I experience a lot of problems with the until then stable ClamAV 0.65 on OpenBSD/Sparc64 and i386. clamd hangs at leats twice a day, does no longer respond to network connections. It has to be killed and restarted. It has becom

Re: [Clamav-users] OSX build problem with 0.65

2004-01-21 Thread Mark Edwards
On Jan 21, 2004, at 3:11 AM, Nigel Horne wrote: These changes will make clamd compile under OSX10.1. The bad news is it's rather doubtful that ClamAV supports that operating system any more. It's best to ask Tomasz to put the support back in. The good news is that this part of the code is only

Re: [Clamav-users] Multiple stability problems on Solaris 9

2004-01-21 Thread Tomasz Papszun
On Wed, 21 Jan 2004 at 11:45:11 -0500, Jon R. Kibler wrote: [...] > This was submitted to [EMAIL PROTECTED] yesterday... just curious, is there any type of acknowledgment that we should expect from such submittals? > [...] Jon, the server which serves your domain (mx001.mail.trustem.net) permane

RE: [Clamav-users] Maildrop core dump and clamd

2004-01-21 Thread Tom Walsh
> Since a couple of days I'm using clamd/clamdscan on an OpenBSD > (snapshot/i386) machine. Clamd is started at boot time and > clamdscan is being used by means of a maildrop filter... if > (`/usr/local/bin/clamdscan --mbox --disable-summary --stdout > - | grep -c 'FOUND'` == 1) { > to "$DE

Re: [Clamav-users] Maildrop core dump and clamd

2004-01-21 Thread Tomasz Kojm
On Wed, 21 Jan 2004 19:52:45 +0100 Björn Ketelaars <[EMAIL PROTECTED]> wrote: > 2.) When using StreamSaveToDisk clamdscan is initiated, does its > thing.and does not die! The result of clamdscan not dying is that > after a couple of hours there are about 40 (or more...) clamdscan > processes runni

[Clamav-users] Sessions aborted from timeouts

2004-01-21 Thread Orion Poplawski
I've been seeing some viruses come in due to clamd timing out. What concerns me is that these emails arrive with the: X-Virus-Scanned: ClamAV version 'clamd / ClamAV version 0.65', clamav-milter version '0.60p' header in place, but in fact it *hasn't* been scanned. -- Orion Poplawski System Ad

[Clamav-users] Clamav-devel massive memory leaks

2004-01-21 Thread Stefan Kaltenbrunner
Hi All! Since clamd in 0.65 is much too unstable here (stops responding within minutes), we have been running several development snapshots here. all the snapshots from the last 14 days or so seem to massivily leak memory. typically our mailrelays do run out of memory(1GB physical and 2Gb swap)

[Clamav-users] Mailscanner, sendmail 8.12, split input queues

2004-01-21 Thread Leif Neland
The Mailscanner docs tells us to make two queues and run two copies of sendmail: drwxr-x--- 2 root bin 62976 Oct 23 16:18 mqueue drwxr-x--- 2 root bin 41472 Oct 23 16:18 mqueue.in sendmail -bd -OPrivacyOptions=noetrn -ODeliveryMode=queueonly -OQueueDirecto ry=/var/spool/mqueue.in

Re: [Clamav-users] Clamav-devel massive memory leaks

2004-01-21 Thread clamav
At 01:37 PM 1/21/2004, Stefan Kaltenbrunner wrote: Since clamd in 0.65 is much too unstable here (stops responding within minutes), we have been running several development snapshots here. all the snapshots from the last 14 days or so seem to massivily leak memory. typically our mailrelays do ru

Re: [Clamav-users] Mailscanner, sendmail 8.12, split input queues

2004-01-21 Thread Peter Bonivart
Leif Neland wrote: How does this fit in with sendmail 8.12 already having two queues, mqueue and mqueue-client? You really should have posted this on the MailScanner list since nothing of this is Clam related. However the mqueue-client does not have a physical queue, instead it's a way of pickin

Re: [Clamav-users] Mailscanner, sendmail 8.12, split input queues

2004-01-21 Thread Kevin Spicer
On Wed, 2004-01-21 at 22:19, Peter Bonivart wrote: > Leif Neland wrote: > > How does this fit in with sendmail 8.12 already having two queues, mqueue > > and mqueue-client? > > You really should have posted this on the MailScanner list since nothing > of this is Clam related. I'll second that,

Re: [Clamav-users] LogSyslog logs twice?

2004-01-21 Thread Darryl Luff
Tomasz Papszun wrote: On Wed, 21 Jan 2004 at 12:51:44 +1100, Darryl Luff wrote: Has anyone noticed that enabling the LogSyslog option causes everything to be logged twice? Or is it just something odd on my machine (sample below)? Jan 20 00:11:02 gateway clamd[19226]: Reading databases from