Re: [Clamav-users] testvirus.org eicar tests failing w/ ClamAV version devel-20040316 on OSX+CGPro

2004-04-02 Thread Nigel Horne
On Friday 02 Apr 2004 12:46 am, OpenMacNews wrote: > has this "endian-ness" issue been addressed? or somehow otherwise resolved? If you have an endian-ness issue please let us know. I know of none (I regularly test and develop ClamAV on Linux/ppc and OS/X and all works fine) but that doesn't mean

[Clamav-users] (bez tematu)

2004-04-02 Thread Mariusz Miller
--- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&all

Re: [Clamav-users] exiscan and clamd 0.70 devel-20040316

2004-04-02 Thread Odhiambo Washington
* Michael V. Sokolov <[EMAIL PROTECTED]> [20040402 10:09]: wrote: > > sirs, we have quite uncomfortable situation: messages with size >1 mb > periodically resends to us, because remote side got: > delay=1539, status=deferred (conversation with proton.ecros.ru[62.141.114.17

Re: [Clamav-users] exiscan and clamd 0.70 devel-20040316

2004-04-02 Thread Odhiambo Washington
* Michael V. Sokolov <[EMAIL PROTECTED]> [20040402 11:51]: wrote: > On Friday 02 April 2004 12:05, Odhiambo Washington wrote: > > > Why check messages larger than 1MB for viruses? I seriuosly doubt they > > could contain malware, though it's possible. I don't sca

[Clamav-users] RPM Stability

2004-04-02 Thread WipeOut
Hi is anyone have stability issues with Petr Kristov's RPM's ?? I am running them on Fedora Core 1.. The problem is when I try to use clamscan or clamdscan/clamd with my mail server it causes the mail server to crash.. The mail server people are telling me it clamav thats crashing.. I am able

[Clamav-users] Freshclam : received signal 14, terminating

2004-04-02 Thread Fajar A. Nugraha
Hi, For some time now, freshclam from latest CVS snapshots (including today) failed to stay daemonized. I could, of course, run it from crontab, but I'd like to run it as daemon with freshclam -d. Any idea what's wrong? -- freshclam daemon started (pid=64080)

Re: [Clamav-users] RPM Stability

2004-04-02 Thread John Jolet
On Friday 02 April 2004 04:22 am, WipeOut wrote: > Hi is anyone have stability issues with Petr Kristov's RPM's ?? > > I am running them on Fedora Core 1.. > > The problem is when I try to use clamscan or clamdscan/clamd with my > mail server it causes the mail server to crash.. The mail server peo

Re: [Clamav-users] RPM Stability

2004-04-02 Thread Fajar A. Nugraha
WipeOut wrote: Hi is anyone have stability issues with Petr Kristov's RPM's ?? I am running them on Fedora Core 1.. The problem is when I try to use clamscan or clamdscan/clamd with my mail server it causes the mail server to crash.. The mail server people are telling me it clamav thats crashi

Re: [Clamav-users] RPM Stability

2004-04-02 Thread Steven Stern
On Fri, 02 Apr 2004 11:22:11 +0100, WipeOut <[EMAIL PROTECTED]> wrote: >Hi is anyone have stability issues with Petr Kristov's RPM's ?? > >I am running them on Fedora Core 1.. > >The problem is when I try to use clamscan or clamdscan/clamd with my >mail server it causes the mail server to crash..

Re: [Clamav-users] RPM Stability

2004-04-02 Thread WipeOut
John Jolet wrote: On Friday 02 April 2004 04:22 am, WipeOut wrote: Hi is anyone have stability issues with Petr Kristov's RPM's ?? I am running them on Fedora Core 1.. The problem is when I try to use clamscan or clamdscan/clamd with my mail server it causes the mail server to crash.. The mai

[Clamav-users] cgi and resend email if false-postive

2004-04-02 Thread Norman Maurer
hi guys, is it possible to resend an email when its a false-postive? i want to resend it if i klick on "NOT SPAM" anyone has that get worked? Bye --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Danie

[Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Richard Humphrey
Sorry for the cross-post but I figured someone would know the answer. Is anyone using mrtg to gather stats on spam/virus activity? I havbe seen some how-to's but they require using apps like MailScanner etc. I am using Sendmail/SpamAssassin/clamav-milter combo and would like to set up mrtg to m

Re: [Clamav-users] Freshclam : received signal 14, terminating

2004-04-02 Thread Graham Murray
"Fajar A. Nugraha" <[EMAIL PROTECTED]> writes: > Happens (at least) on Solaris (8 & 9), AIX, OSF. > Regards, I am seeing the same thing on Linux. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Danie

Re: [Clamav-users] RPM Stability

2004-04-02 Thread WipeOut
Steven Stern wrote: On Fri, 02 Apr 2004 11:22:11 +0100, WipeOut <[EMAIL PROTECTED]> wrote: Hi is anyone have stability issues with Petr Kristov's RPM's ?? I am running them on Fedora Core 1.. The problem is when I try to use clamscan or clamdscan/clamd with my mail server it causes the mail

[Clamav-users] test message

2004-04-02 Thread Tomasz Klim
This is a test message only. I'm sending it only to announce my e-mail address to all infected e-mail clients, to provoke them to send a copy of viruses. Don't be angry. -- Tomasz Klim, [EMAIL PROTECTED] http://www.euroneto.pl Phone: +48 61 8433535 Fax: +48 61 8434455

[Clamav-users] ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Howdy list, We've been running CVS version devel-20040325 for about a week with great success, but just this morning it locked up. I tried: telnet -u /tmp/clamd But it told me the connection was refused. I had to kill -9 the clamd process to unlock it. CPU load was low, but no connections were b

[Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Jesse Guardiani wrote: [...] > I there any chance this bug has been fixed in the > latest CVS? There must be some special email out there that triggers this behavior. I've had to kill -9 the clamd process 3 times since my first message about this problem to this list. If it happens again then I'

[Clamav-users] Re: test message

2004-04-02 Thread Bob George
Tomasz Klim wrote: This is a test message only. I'm sending it only to announce my e-mail address to all infected e-mail clients, to provoke them to send a copy of viruses. Don't be angry. Go sign up on a bunch of MSN or Yahoo group lists and announce there. I think you'll find those a much more e

Re: [Clamav-users] ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Odhiambo Washington
* Jesse Guardiani <[EMAIL PROTECTED]> [20040402 20:12]: wrote: > Howdy list, > > We've been running CVS version devel-20040325 > for about a week with great success, but just > this morning it locked up. I tried: I haven't had the same problems you are seeing

[Clamav-users] "write failure to clamd"

2004-04-02 Thread Orion Poplawski
I found a couple posts in the archive about the following messages appearing with 0.70-rc: Mar 28 07:55:53 earth clamav-milter[953]: write failure to clamd Mar 28 07:55:53 earth sendmail[18248]: i2SEqA0C018248: Milter: data, reject=451 4.7.1 Please try again later I had the same problem, regard

Re: [Clamav-users] test message

2004-04-02 Thread Doc Schneider
Tomasz Klim wrote: This is a test message only. I'm sending it only to announce my e-mail address to all infected e-mail clients, to provoke them to send a copy of viruses. Don't be angry. Heck Thomasz if you want viruses I have over 2000 caught in the past couple months. 8*)) -Doc --- MomNDoc

Re: [Clamav-users] test message

2004-04-02 Thread Tomasz Papszun
On Fri, 02 Apr 2004 at 14:55:27 +, Tomasz Klim wrote: > This is a test message only. I'm sending it only to announce > my e-mail address to all infected e-mail clients, to provoke > them to send a copy of viruses. Don't be angry. > > -- > Tomasz Klim, [EMAIL PROTECTED] > http://www.eu

Re: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Todd Lyons
On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote: > > I there any chance this bug has been fixed in the > > latest CVS? > There must be some special email out there that triggers > this behavior. I've had to kill -9 the clamd process 3 > times since my first message about this problem to this >

Re: [Clamav-users] test message

2004-04-02 Thread Antony Stone
On Friday 02 April 2004 6:56 pm, Doc Schneider wrote: > Tomasz Klim wrote: > > This is a test message only. I'm sending it only to announce > > my e-mail address to all infected e-mail clients, to provoke > > them to send a copy of viruses. Don't be angry. > > Heck Thomasz if you want viruses I ha

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Jakub Jankowski
On 2004-04-02, Richard Humphrey wrote: >Is anyone using mrtg to gather stats on spam/virus activity? I havbe >seen some how-to's but they require using apps like MailScanner etc. I >am using Sendmail/SpamAssassin/clamav-milter combo and would like to set >up mrtg to monitor activity. Any simple ho

Re: [Clamav-users] "write failure to clamd"

2004-04-02 Thread Todd Lyons
On Fri, 2004-04-02 at 09:40, Orion Poplawski wrote: > Mar 28 07:55:53 earth clamav-milter[953]: write failure to clamd > Mar 28 07:55:53 earth sendmail[18248]: i2SEqA0C018248: Milter: data, > reject=451 4.7.1 Please try again later > I had the same problem, regardless of message size, and downgrad

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread John Madden
> #!/bin/sh > VIRCOUNT=`grep -c FOUND /wherever/is/your/clamd.log` I blend in a little perl to print per-virus totals sorted by name: grep VIRUS /var/log/messages | perl -e 'while(<>){ $_ =~ /VIRUS:(.*)\)/; $v = $1; $hash{$v}++;} foreach $x (sort(keys(%hash))){ print "$x: $hash{$x} \n";}' (Note

[Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Odhiambo Washington wrote: > * Jesse Guardiani <[EMAIL PROTECTED]> [20040402 20:12]: wrote: >> Howdy list, >> >> We've been running CVS version devel-20040325 >> for about a week with great success, but just >> this morning it locked up. I tried: >

Re: [Clamav-users] "write failure to clamd"

2004-04-02 Thread Orion Poplawski
Todd Lyons wrote: On Fri, 2004-04-02 at 09:40, Orion Poplawski wrote: Mar 28 07:55:53 earth clamav-milter[953]: write failure to clamd Mar 28 07:55:53 earth sendmail[18248]: i2SEqA0C018248: Milter: data, reject=451 4.7.1 Please try again later I had the same problem, regardless of message size, a

[Clamav-users] Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Todd Lyons wrote: > On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote: > >> > I there any chance this bug has been fixed in the >> > latest CVS? >> There must be some special email out there that triggers >> this behavior. I've had to kill -9 the clamd process 3 >> times since my first message a

Re: [Clamav-users] ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Robert Blayzor
On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote: > Howdy list, > > > # uname -a > FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri Apr 11 > 12:59:08 EDT 2003 [EMAIL PROTECTED]:/usr/src/sys/compile/CHORTOS > i386 > > MaxThreads 5 > ThreadTimeout 500 Maybe i

Re: [Clamav-users] RPM Stability

2004-04-02 Thread Steven Stern
On Fri, 02 Apr 2004 15:49:00 +0100, WipeOut <[EMAIL PROTECTED]> wrote: >I am using a mail server called surgemail which calls the command line >virus scanner.. Aha. I don't know enough of the internals to know if that's more or less efficient than a sendmail milter. -- Steve ---

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Chris Meadors
On Fri, 2004-04-02 at 14:33 -0500, John Madden wrote: > > #!/bin/sh > > VIRCOUNT=`grep -c FOUND /wherever/is/your/clamd.log` > > I blend in a little perl to print per-virus totals sorted by name: > > grep VIRUS /var/log/messages | perl -e 'while(<>){ $_ =~ /VIRUS:(.*)\)/; > $v = $1; $hash{$v}++;

[Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Robert Blayzor wrote: > On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote: > >> Howdy list, >> >> >> # uname -a >> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri Apr >> 11 >> 12:59:08 EDT 2003 >> [EMAIL PROTECTED]:/usr/src/sys/compile/CHORTOS i386 >> >> Ma

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Daniel J McDonald
On Fri, 2004-04-02 at 14:47, Chris Meadors wrote: > On Fri, 2004-04-02 at 14:33 -0500, John Madden wrote: > > > > #!/bin/sh > > > VIRCOUNT=`grep -c FOUND /wherever/is/your/clamd.log` > > > > I blend in a little perl to print per-virus totals sorted by name: > > > > grep VIRUS /var/log/messages |

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Antony Stone
On Friday 02 April 2004 10:46 pm, Daniel J McDonald wrote: > grep FOUND clamd.log | cut -d \ -f 2 | sort | uniq -c > > I'm sure someone could swap the final order for you... grep FOUND clamd.log | cut -d \ -f 2 | sort | uniq -c | awk '{print $2,$1}' Regards, Antony. -- In Heaven, the police

Re: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Brian Bruns
On Fri, April 2, 2004 4:29 pm, Jesse Guardiani said: > > Why would you want to run more than five threads concurrently on a single > processor box? Queue the remaining connections (and make sure your queue > is > large enough) and you'll run more efficiently by avoiding thread context > switching

[Clamav-users] Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
n if you feel like testing, grab CVS (HEAD) from today. I tried 2004/04/02 via CVS checkout: # telnet -u /tmp/clamd Trying /tmp/clamd... No connection. Escape character is '^]'. VERSION clamd / ClamAV version devel-20040402 Connection closed by foreign host. Exit 1 With no luck. It

[Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Jesse Guardiani wrote: > Robert Blayzor wrote: > >> On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote: >> >>> Howdy list, >>> >>> >>> # uname -a >>> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri Apr >>> 11 >>> 12:59:08 EDT 2003 >>> [EMAIL PROTECTED]:/usr/src/

Re: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Christopher X. Candreva
On Fri, 2 Apr 2004, Jesse Guardiani wrote: > Just for fun I tried setting the max thread limit to 100, and it's still hanging > up every ten minutes or so like clockwork. This stinks. I'm running into a similar problem with 0.68 clamav-milter hanging up under heavy load. I had max threads at 40

Re: [Clamav-users] Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Todd Lyons
On Fri, 2004-04-02 at 14:09, Jesse Guardiani wrote: > Mar 31 didn't work for me. See other email on the subject. You can download the tarball that I used for mine at http://downloads.mrball.net/SpamAssassin/clamav-0.70pre2.tar.gz The naming convention does not jive with clamav's official naming,

[Clamav-users] Worm.SomeFool.R - what happened to Q?

2004-04-02 Thread B.K. DeLong
Did we skip from SomeFool.P to SomeFool.R ? What happened to SomeFool.Q ? -- B.K. DeLong [EMAIL PROTECTED] +1.617.797.2472 http://ocw.mit.eduWork. http://www.brain-stream.com Play. http://www.the-leaky-cauldron.orgPotter. http://www.city-of-doors.com

Re: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Internet Helpdesk
- Original Message - From: "Jesse Guardiani" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, April 02, 2004 3:29 PM Subject: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability > > My mailserver doesn't reject any mail with only 5 threads. The high > MaxConnectionQ

Re: [Clamav-users] Worm.SomeFool.R - what happened to Q?

2004-04-02 Thread Daniel J McDonald
On Fri, 2004-04-02 at 16:53, B.K. DeLong wrote: > Did we skip from SomeFool.P to SomeFool.R ? What happened to SomeFool.Q ? After getting level 1 alerts from Homeland Security on SomeFool.Q, I received about 6 per day at this electric utility with 1400 mailboxes. Meanwhile, SomeFool.P, for which

[Clamav-users] Re: Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Todd Lyons wrote: > On Fri, 2004-04-02 at 14:09, Jesse Guardiani wrote: > >> Mar 31 didn't work for me. See other email on the subject. > > You can download the tarball that I used for mine at > http://downloads.mrball.net/SpamAssassin/clamav-0.70pre2.tar.gz > > The naming convention does not j

[Clamav-users] Re: Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
m guessing that it's hanging at the vfprintf()? Which would indicate a logging problem, right? I'm going to try uncommenting LogFileUnlock in clamav.conf. (The below output is with CVS from 20040402) Attaching to program: /usr/local/sbin/clamd, process 25840 Reading symbols from /usr

[Clamav-users] Re: Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Jesse Guardiani wrote: [...] > I'm going to try uncommenting LogFileUnlock in clamav.conf. That didn't work. Help! I'm at a loss... -- Jesse Guardiani, Systems Administrator WingNET Internet Services, P.O. Box 2605 // Cleveland, TN 37320-2605 423-559-LINK (v) 423-559-5145 (f) http://www.wing

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Jakub Jankowski
On 2004-04-02, Antony Stone wrote: >On Friday 02 April 2004 10:46 pm, Daniel J McDonald wrote: > >> grep FOUND clamd.log | cut -d \ -f 2 | sort | uniq -c > >grep FOUND clamd.log | cut -d \ -f 2 | sort | uniq -c | awk '{print $2,$1}' grep FOUND clamd.log | awk '{print $8}' | sort | uniq -c | sor

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Rick Macdougall
Hi, Jakub Jankowski wrote: grep FOUND clamd.log | awk '{print $8}' | sort | uniq -c | sort -k1nr,1 Appears to be faulty due to spaces in the name of the file, I get entries like 35 .pif: 15 .scr: 11 .exe: Please try again :) Or see http://mail.limelyte.net/admin/qsla/ Regards, Rick --

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Jakub Jankowski
On 2004-04-02, Rick Macdougall wrote: >> grep FOUND clamd.log | awk '{print $8}' | sort | uniq -c | sort -k1nr,1 >> >Appears to be faulty due to spaces in the name of the file, I get >entries like Might be, use something like grep FOUND clamd.log | cut -d: -f4 | awk '{print $1}' | sort | uniq -c

[Clamav-users] Re: Re: Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Jesse Guardiani
Jesse Guardiani wrote: > Jesse Guardiani wrote: > > [...] > >> I'm going to try uncommenting LogFileUnlock in clamav.conf. > > > That didn't work. Help! I'm at a loss... Hmmm... Reverting to 0.70-rc seems to solve the problem -- Jesse Guardiani, Systems Administrator WingNET Internet Se

Re: [Clamav-users] exiscan and clamd 0.70 devel-20040316

2004-04-02 Thread Nigel Horne
On Friday 02 Apr 2004 9:05 am, Odhiambo Washington wrote: > Why check messages larger than 1MB for viruses? I seriuosly doubt they > could contain malware, though it's possible. I don't scan messages >1MB. Word documents can easily be larger than 1MB and such documents may contain macro viruses.

Re: [Clamav-users] test message

2004-04-02 Thread Doc Schneider
Antony Stone wrote: On Friday 02 April 2004 6:56 pm, Doc Schneider wrote: Tomasz Klim wrote: This is a test message only. I'm sending it only to announce my e-mail address to all infected e-mail clients, to provoke them to send a copy of viruses. Don't be angry. Heck Thomasz if you want viruse

[Clamav-users] Mails Backup Copy

2004-04-02 Thread Muhammad Kashif Muneer
Dear Members, I really found this list very helpful before while installing ClamAV. Now I need another help. Before question I would like to introduce working environment. I am using Redhat Linux 9.0 and Sendmail as mail server. ClamAV 0.67 as Antivirus. Now I need to make a backup copy of each ma

Re: [Clamav-users] Re: ClamAV CVS version devel-20040325 instability

2004-04-02 Thread Odhiambo Washington
* Jesse Guardiani <[EMAIL PROTECTED]> [20040402 23:24]: wrote: > Odhiambo Washington wrote: > > > * Jesse Guardiani <[EMAIL PROTECTED]> [20040402 20:12]: wrote: > >> Howdy list, > >> > >> We've been running CVS version devel-20040325 >

Re: [Clamav-users] test message

2004-04-02 Thread Tomasz Klim
> Heck Thomasz if you want viruses I have over 2000 caught in the past > couple months. 8*)) Could you please send me a copy of them? Thanks! -- Tomasz Klim, [EMAIL PROTECTED] http://www.euroneto.pl Phone: +48 61 8433535 Fax: +48 61 8434455 Euronet Sp. z o.o., Dabr