maybe it is some Virus :)
- Original Message -
From: "Eperez" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 31, 2004 5:47 AM
Subject: [Clamav-users] tons of Worm.SomeFool
> I have tons of email attachments being detected as Worm.Somefool.
> what is this?
>
> Thanks,
On Wed, 2004-03-31 at 03:52, Fajar A. Nugraha wrote:
> bash-2.03# /usr/local/sbin/clamd
> ERROR: Parse error at line 71: Unknown option ThreadTimeout.
> ERROR: Can't open/parse the config file /usr/local/etc/clamav.conf
> Looking at ChangeLog :
>
> Tue Mar 30 08:40:10 BST 2004 (trog)
> --
On Wed, 2004-03-31 at 04:24, Miles Davis wrote:
>
> Have you ever made any progress with your problem? I'm pretty sure I'm
> hitting the same thing; 0.70rc, RH 9, though I'm using exim with the
> exiscan patch instead of sendmail. Clamd will run for anywhere from 1
> minute to an hour and segfault
On Wed, 31 Mar 2004 13:08:09 +0700, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote:
> Eperez wrote:
>>ClamAV.xs:11:20: clamav.h: No such file or directory
>>make[1]: *** [ClamAV.o] Error 1
>>
>>
> error #2 : don't know about this one.
>
Depending how you install clamav, clamav devel package
On Tue, 30 Mar 2004 16:03:07 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
> by. 2) clamd does not scan anything if the stream is larger than
> StreamMaxLength - sizeof(buff).
That's not true.
>In my book thats a bug. It should read up to the max.
It does.
--
oo. Tomasz
On Tue, 30 Mar 2004 18:37:53 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
> Anyone care to try these? fresh from the oven. barely tested.
> + btread = ( (maxsize && ( size + btread > maxsize)) ?
> (maxsize - size) : btread);
The patch is incorrect.
--
oo. Tomasz Kojm
On Tue, 30 Mar 2004 19:24:32 -0800
Miles Davis <[EMAIL PROTECTED]> wrote:
> Have you ever made any progress with your problem? I'm pretty sure I'm
> hitting the same thing; 0.70rc, RH 9, though I'm using exim with the
> exiscan patch instead of sendmail. Clamd will run for anywhere from 1
> minute
On Tue, 30 Mar 2004 18:11:05 -0500
Ryan Moore <[EMAIL PROTECTED]> wrote:
> Bill Maidment wrote:
> > Hi
> >
> > I'm usinf clamav-0.68-1 and occasionally (once every two weeks) I
> > get this response
> >
> > ClamAV update process started at Tue Mar 30 08:46:36 2004
> > SelfCheck: Database status
Virgo Pärna wrote:
On Wed, 31 Mar 2004 13:08:09 +0700, Fajar A. Nugraha <[EMAIL PROTECTED]> wrote:
Eperez wrote:
ClamAV.xs:11:20: clamav.h: No such file or directory
make[1]: *** [ClamAV.o] Error 1
error #2 : don't know about this one.
Depending how you install clamav, cla
Trog wrote:
ThreadTimeout hasn't been used for several months, I've stated this on
this list several times.
Hmm ... must've missed this.
Previous snapshot seems to ignore it anyway. The latest snapshot rejets it.
How about freshclam (Received signal 14, terminating instead of Received
signal 1
Hi!
can someone with experience with RAR archives please have a look at
http://bugs.gentoo.org/show_bug.cgi?id=45357 and tell me if that is the
'correct' behaviour (since it can't open the .rar file..)
regards
P.S.: please comment there if possible
--
-BEGIN GEEK CODE BLOCK-
GCS/CC/E/M
Tomasz Kojm wrote:
On Tue, 30 Mar 2004 18:37:53 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
Anyone care to try these? fresh from the oven. barely tested.
+ btread = ( (maxsize && ( size + btread > maxsize)) ?
(maxsize - size) : btread);
The patch is incorrect.
Works for m
With respect for your considerably greater experience and skill set
than mine.
Tomasz Kojm wrote:
On Tue, 30 Mar 2004 16:03:07 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
by. 2) clamd does not scan anything if the stream is larger than
StreamMaxLength - sizeof(buff).
That's not
Hi,
Clam eats up most CPU usage :(
The O/p of top is,
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND
440 mailnull 9 0 12384 12M 920 S99.9 6.4 0:07 clamd
487 mysql
On Wednesday 31 Mar 2004 12:48 pm, Dilip M wrote:
> Clam eats up most CPU usage :(
What version?
What operating system?
What options are you giving to clamav.conf?
Have you tested the version in CVS to see if it has been fixed there?
> Regards,
> -Dilip
-Nigel
--
Nigel Horne. Arranger, Compo
On Wednesday 31 March 2004 4:47 am, Eperez wrote:
> I have tons of email attachments being detected as Worm.Somefool.
> what is this?
It is an epidemic.
Antony.
--
"Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
Blaster]. However, these products are no longer supported
On Tue, 30 Mar 2004, Tomasz Kojm wrote:
> The spam is encoded into an ASCII array, something like:
>
> earthling = new Array(252,
> 177,106,210,160,139,71,177,228,121,83...
>
> and there's a simple decoder. I'm not familiar with anti-spam software
> but I was told it should catch this type of spam.
> I have tons of email attachments being detected as Worm.Somefool.
> what is this?
A demonstration that clamAV is doing it's job and saving you grief.
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
--
On Wed, 31 Mar 2004 06:13:01 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
> >It does.
> >
> >
> >
> It does not. Any stream that is larger than (maxsize - sizeoff(buf))
Shame on me ! You're right. Some kind of a code sclerosis pesters me
recently.
--
oo. Tomasz Kojm <[EMAIL
On Solaris with Sun's compilers and latest CVS source I get the
following error on configure. I have not seen this error before and I
have been building clamav with Sun's compiler for many months from the
released source and occasionally from CVS source.
| int main(int argc, char **argv) {
| #pra
Hmmm, funny - since I received this error as postmaster the sourceforge
verification engine seems to have a bug :-)
Perhaps this will make it through - original question is about a virus
that appears to get through Clam AV and if my setup is correct or not.
--- Begin Message ---
The original mes
Using clamav-devel-20040326
Message file tests 21, 23, 24 and 25 from www.testvirus.org all make it
through clamdscan w/ ScanMail.
--
Robert Blayzor, BOFH
INOC, LLC
[EMAIL PROTECTED]
PGP: http://www.inoc.net/~dev/
Key fingerprint = 1E02 DABE F989 BC03 3DF5 0E93 8D02 9D0B CB1A A7B0
(A)bort, (R)e
On Wed, Mar 31, 2004 at 02:04:55PM +0100, Nigel Horne wrote:
> > I have tons of email attachments being detected as Worm.Somefool.
> > what is this?
>
> A demonstration that clamAV is doing it's job and saving you grief.
Nobody has given him this answer which is what I think he is looking
for:
I
Another attempt
--- Begin Message ---
The original message was received at Wed, 31 Mar 2004 06:36:07 -0800
from [1.0.24.3]
- The following addresses had permanent fatal errors -
<[EMAIL PROTECTED]>
(reason: 550-Postmaster verification failed while checking <[EMAIL PROTECTED]>)
-
On Wed, 2004-03-31 at 14:50, Alex S Moore wrote:
> On Solaris with Sun's compilers and latest CVS source I get the
> following error on configure. I have not seen this error before and I
> have been building clamav with Sun's compiler for many months from the
> released source and occasionally fro
On Wednesday 31 March 2004 3:32 pm, Robert Blayzor wrote:
> Using clamav-devel-20040326
>
> Message file tests 21, 23, 24 and 25 from www.testvirus.org all make it
> through clamdscan w/ ScanMail.
That's because none of those tests contains a virus - not even a pretend one
such as Eicar.
Since
On Wed, 2004-03-31 at 15:28, Steven P. Donegan wrote:
>
> I have Clam AV with current database and over the last 2 days have seen
> an ever-increasing load of what Norton says:
>
> Norton AntiVirus removed the attachment: msg.zip.
> The attachment was infected with the [EMAIL PROTECTED] virus.
>
On 3/31/04 9:51 AM, "Antony Stone" <[EMAIL PROTECTED]> wrote:
> That's because none of those tests contains a virus - not even a pretend one
> such as Eicar.
>
> Since there's no virus, ClamAV doesn't have anything to detect.
That may be true for Test #24, but on test 21, 23 and 25 every one tha
On Wednesday 31 March 2004 4:34 pm, Robert Blayzor wrote:
> On 3/31/04 9:51 AM, "Antony Stone" <[EMAIL PROTECTED]> wrote:
> > That's because none of those tests contains a virus - not even a pretend
> > one such as Eicar.
> >
> > Since there's no virus, ClamAV doesn't have anything to detect.
>
>
On Wed, Mar 31, 2004 at 10:02:03AM +0200, Tomasz Kojm wrote:
> On Tue, 30 Mar 2004 19:24:32 -0800
> Miles Davis <[EMAIL PROTECTED]> wrote:
>
> > Have you ever made any progress with your problem? I'm pretty sure I'm
> > hitting the same thing; 0.70rc, RH 9, though I'm using exim with the
> > exisc
Hi,
I run clamdscan from within a script and wanted to know if
it is possible to detect any problem with clamd when running
clamdscan?
Last night clamd ran into a strange problem, I don't know
what it was, but basically it seemed to be stuck and all
instances of my script were basically "hung".
On Wed, 2004-03-31 at 08:51, Trog wrote:
> Have you changed the compiler version? Which version is it? What
> architecture are you using (generic, v7, v8, v8a, v8plus, v8plusa, v9,
> v9a)
>
We have been using this compiler for many months. It is called Sun ONE
Studio 8. Here is some output.
[EMA
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Robert
> Blayzor
> Sent: Wednesday, March 31, 2004 10:35 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Clamav-users] testvirus.org results
>
>
> On 3/31/04 9:51 AM, "Antony Stone" <[EMAIL PROTECTED]> wrote:
On Tue, 2004-03-30 at 23:39, Trog wrote:
> On Wed, 2004-03-31 at 04:24, Miles Davis wrote:
> >
> > I tried setting the LD_ASSUME_KERNEL env var as I saw in one of your
> > previous posts, but now clamd seems to lock up
I updated to CVS yesterday (since the swap out of the macro viruses
signatures) and since then I got all sorts of nastiness with regards to MS
Office docus:
ClamAV returned
/var/spool/exim/scan/1B8XDU-0002NR-5W/1B8XDU-0002NR-5W-2.doc: Unable
to open file or directory. ERROR
for example. I tr
On Wed, 2004-03-31 at 18:25, Alex S Moore wrote:
>
> It looks like it worked each time, assuming that I did this correctly.
> Here is the ouptut.
Ok, so it accepts the #pragma pack(1)
Could you try it with whatever compile options configure used, which
should be in config.log
Thanks
-trog
Ran the following ./configure:
./configure --disable-urandom --disable-clamav --enable-milter
--with-user="clamav" --with-group="clamav" --with-dbdir=/var/clamav
When trying to build, the milter build fails because it's still looking
for cfgfile.h. Changed clamav-milter/clamav-milter.c to includ
The following seems to work on my system. YMMV.
--- clamav-0.70pre2/clamav-milter/Makefile.am 2004-03-31
10:32:40.0 -0800
+++ clamav-0.70pre.new/clamav-milter/Makefile.am2004-03-31
12:35:06.0 -0800
@@ -24,6 +24,8 @@
clamav_milter_SOURCES = \
$(top_srcdir)/shared/cf
Would it be possible to make a few changes to the install scripts so that
make install doesn't clobber our config files? That would be most
helpful. I personally like the approach of installing the file if it
doesn't exist but installing a name.conf.example file if one does already
exist. It
On Wed, 31 Mar 2004 09:20:06 -0800
"Ricardo Kleemann" <[EMAIL PROTECTED]> wrote:
> Hi,
>
> I run clamdscan from within a script and wanted to know if
> it is possible to detect any problem with clamd when running
> clamdscan?
clamd should report all problems in clamdscan's output:
file: Error_d
On Wednesday 31 Mar 2004 9:06 pm, Todd Lyons wrote:
> Ran the following ./configure:
I haven't bothered committing the fix for this while I was waiting for the
makefile system to be fixed so that clamav-milter would build again.
This has now been done, thanks to Tomasz K., and the new clamav-milte
On 31 Mar 2004 20:49:51 +0100
Trog <[EMAIL PROTECTED]> wrote:
> On Wed, 2004-03-31 at 18:25, Alex S Moore wrote:
> >
> > It looks like it worked each time, assuming that I did this correctly.
> > Here is the ouptut.
>
> Ok, so it accepts the #pragma pack(1)
>
> Could you try it with whatever c
> > and restarted clamd. Maybe clamd was leaking threads
> > (I'm running 0.65)?
>
> 0.65 ? Good luck..
>
Why do you say that? I've been using 0.65 with moderate
traffic for quite some time, last night was the first time I
had problems... I wasn't aware it's considered a bad
release?
Which is
On Wed, 2004-03-31 at 22:21, Alex S Moore wrote:
>
> Well, trog, don't I feel like the dummy. I do not see what to try. The tests look
> jumbled up to me and I wonder if the failure on the -lwrap test is causing the
> problem. I think that all that is missing from my test compiles is the -I f
Hello All
How do I get clamav and clamav-milter not to send auto-reply / autoresponses to the senders of email viruses.
99% of these are forged anyway.
Specifically, messages like:
> A message you sent to> <[EMAIL PROTECTED]>> contained a virus and has not been delivered.> stream: W
pass "--quiet" in the command line to clamav-milter
Howie Grapek wrote:
Hello All
How do I get clamav and clamav-milter not to send auto-reply /
autoresponses to the senders of email viruses.
99% of these are forged anyway.
Specifically, messages like:
> A message you sent to
> <[EMAIL PROTE
On 31 Mar 2004 22:59:56 +0100
Trog <[EMAIL PROTECTED]> wrote:
> and the problem is not due to the #pragma packed test, but is due to
> configure trying to link tcpwrapper (-lwrap) in.
>
> You could try:
>
> ./configure --without-tcpwrappers
Yes, thanks Trog. That worked.
Configure returne
Or --postmaster-only if you still want to get notifications yourself.
Risto
Tristan Griffiths wrote:
pass "--quiet" in the command line to clamav-milter
Howie Grapek wrote:
Hello All
How do I get clamav and clamav-milter not to send auto-reply /
autoresponses to the senders of email viruses.
On Wed, 2004-03-31 at 15:15, Howie Grapek wrote:
> Hello All
>
> How do I get clamav and clamav-milter not to send auto-reply /
> autoresponses to the senders of email viruses.
[EMAIL PROTECTED] root]# cat /etc/sysconfig/clamav-milter
### Simple config file for clamav-milter, you should
### rea
Ricardo Kleemann wrote:
Hi,
I run clamdscan from within a script and wanted to know if
it is possible to detect any problem with clamd when running
clamdscan?
Last night clamd ran into a strange problem, I don't know
what it was, but basically it seemed to be stuck and all
instances of my script
Justin wrote:
Would it be possible to make a few changes to the install scripts so that
make install doesn't clobber our config files? That would be most
helpful. I personally like the approach of installing the file if it
doesn't exist but installing a name.conf.example file if one does alre
asz K., and the new clamav-milter
has been checked in.
As an aside I have seen no 451 problems with it so far (touch-wood).
Is this part of the fix?
Making all in clamav-milter
make[2]: Entering directory
`/data/download/src/clamav/clamav-auto-build/clamav-devel-20040331/clamav-milter'
Ma
On Thu, 1 Apr 2004, Fajar A. Nugraha wrote:
> Tomasz said that it doesn't overwrite any existing *clam*.conf.
> Personally, I prefer my own wrapper which backs up my
> existing config first, then restore it after make install.
Thanks for the reply. I tried it again just now. I made a backup of
On Thu, 25 Mar 2004, Todd Lyons wrote:
> On Thu, 2004-03-25 at 08:36, Claudio Alonso wrote:
> > Hi,
> > Yesterday I installed clamav-0.70rc-1 from rpm on my RedHat 9.0 (kernel
> > 2.4.20-30.9) and started
> > clamd just to test it's current stability
> > The computer was on all night and today
jamie wrote:
On Thu, 25 Mar 2004, Todd Lyons wrote:
On Thu, 2004-03-25 at 08:36, Claudio Alonso wrote:
Hi,
Yesterday I installed clamav-0.70rc-1 from rpm on my RedHat 9.0 (kernel 2.4.20-30.9) and started
clamd just to test it's current stability
The computer was on all night and today I f
55 matches
Mail list logo
