Hi List
I have a problem with clamd dying without warning.
Nothing appears in the log files.
Below are the lst entries in the log:
Sun Jul 25 04:20:37 2004 -> Reading databases from /usr/local/share/clamav
Sun Jul 25 04:20:47 2004 -> Database correctly reloaded (22911 viruses)
Sun Jul 25 04:50:3
Christopher X. Candreva <> wrote the following on 23 July 2004 23:19:
> On Fri, 23 Jul 2004, Nigel Horne wrote:
>
>> Operating system?
>
> Solaris 8, gcc 3.4.0 . Sorry.
>
>> Please send me a sample which crashes on your machine, zipped with
>> password "virus" please.
>
> Will do -- but the ma
Rob Mangiafico wrote:
+peer_size = sizeof(peer);
+if(getpeername(sockd, (struct sockaddr *) &peer, &peer_size) < 0) {
+ perror("getpeername()");
+ mprintf("@Can't get socket peer name.\n");
+ return -1;
+}
+
+server.sin_addr.s_addr = peer.sin_addr.s_addr;
+
Comment
On Monday 26 Jul 2004 09:23, Sean Cardus wrote:
> LibClamAV debug: boundaryStart: line = 'Segmentation Fault
Fixed.
> Sean
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
--
A.R.S. KA9QLQ Alvin Koffman wrote:
I ran this from a terminal and got
[EMAIL PROTECTED] /]# clamscan -ri /home
/home/ka9qlq/.thunderbird/default/9x8zs2cf.slt/Mail/pop.sbcglobal.yahoo.com/Inbox:
Exploit.IFrame.Gen FOUND
/home/ka9qlq/evolution/local/Inbox/mbox: Worm.Bagle.H-zippwd-1 FOUND
/home/ka9q
On Mon, 2004-07-26 at 08:03, Thomas Kinghorn wrote:
> Hi List
>
> I have a problem with clamd dying without warning.
> Nothing appears in the log files.
> This morning I got in to work and it had failed.
>
> Clamd -V produces:
>
> clamd / ClamAV version 0.72
>
> Any ideas where to look would b
On Mon, 2004-07-26 at 04:07, Albert Whale wrote:
> Just attempted a trial with clamav-0.75 here are the results:
>
> clamscan --mbox *
> Notification: OK
> Virus-Sample.070104: OK
> VirusSample.072504: OK
> VirusSample2.txt: Worm.SomeFool.Gen-1 FOUND
> VirusSample3.txt: Worm.SomeFool.P FOUND
> Vir
* Thomas Kinghorn <[EMAIL PROTECTED]> [20040726 10:26]: wrote:
> Hi List
>
> I have a problem with clamd dying without warning.
> Nothing appears in the log files.
>
> Below are the lst entries in the log:
>
> Sun Jul 25 04:20:37 2004 -> Reading databases from
Hi,
I am on FreeBSD and want to put a form on my
website whereby visitors can send a message plus a CV attachment (probably
in MS Word format). The tricky part is that the attachment will be saved on the
server AND forwarded onto a third party recipient by e-mail.
I already have the scrip
On Monday 26 July 2004 11:46 am, Suril Patel wrote:
> Hi,
>
> I am on FreeBSD and want to put a form on my website whereby visitors can
> send a message plus a CV attachment (probably in MS Word format).
Why not insist on a vendor-neutral format, such as pdf? Not everyone can
read MS Word, and
Trog wrote:
On Mon, 2004-07-26 at 04:07, Albert Whale wrote:
Whats your point?
I'd be worried if the development version caught *less* viruses.
The development version has more features, hence it catches more
viruses.
-trog
My point is two fold. First, the 0.75 release was made on 072204, s
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hi there,
I'm currently running (successfully) a combination of ClamAV and Exiscan
on FreeBSD. I get a problem however when I up the concurrency.
Currently I have it set in exim to 30 (so basically this means that
there will be 30 instances of clamc hi
On Mon, July 26, 2004 10:14, Nigel Horne said:
> On Monday 26 Jul 2004 09:23, Sean Cardus wrote:
>
>> LibClamAV debug: boundaryStart: line = 'Segmentation Fault
>
> Fixed.
Thanks Nigel...
Any idea when the changes will appear on the public CVS servers?
If the changes are small, would you mind po
On Mon, 2004-07-26 at 13:15, Albert Whale wrote:
> Trog wrote:
>
> >On Mon, 2004-07-26 at 04:07, Albert Whale wrote:
> >
> >
> >Whats your point?
> >
> >I'd be worried if the development version caught *less* viruses.
> >
> >The development version has more features, hence it catches more
> >vir
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Antony Stone wrote:
| Yes - you could call "clamscan $filename" before deciding whether to
store &
| forward the file, or you could use one of the standard email-plugin
| techniques to filter all outbound email through ClamAV before
delivering it.
If yo
On Saturday 24 Jul 2004 18:52, Dan O'Brien wrote:
> Additional information:
> Virus: %v
> Daemon Name:{daemon_name}
Yes, the entire template file handling needs major work, I know.
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECT
On Mon, 2004-07-26 at 11:46, Suril Patel wrote:
> I have currently got no AV installed and want to know if installing
> ClamAV will let me call the virus scanner from a PHP script during
> the upload process and reject/accept the attachment based on the
> results.
Yes, easily. I've done the exact
El 24 Jul 2004 a las 15:09, Steven Stern escribió:
>
> Please don't top-post. The easiest way to install clam on RH or Fedora is to
> use the RPMs at crash-hat. see http://www.clamav.net/binary.html#pagestart
Hi,
I noticed that the RPMs for fedora core-1 at crash-hat stood still at clamav-
0.72
>
>
> Trog wrote:
>
> >On Mon, 2004-07-26 at 04:07, Albert Whale wrote:
> >
> >
> >Whats your point?
> >
> >I'd be worried if the development version caught *less* viruses.
> >
> >The development version has more features, hence it catches more
> >viruses.
> >
> >-trog
> >
> >
> >
> My point
On Mon, July 26, 2004 13:53, Sean Cardus said:
> On Mon, July 26, 2004 10:14, Nigel Horne said:
>> On Monday 26 Jul 2004 09:23, Sean Cardus wrote:
>>
>>> LibClamAV debug: boundaryStart: line = 'Segmentation Fault
>>
>> Fixed.
>
> Any idea when the changes will appear on the public CVS servers?
I'v
Nigel Horne <> wrote the following on 26 July 2004 10:14:
> On Monday 26 Jul 2004 09:23, Sean Cardus wrote:
>
>> LibClamAV debug: boundaryStart: line = 'Segmentation Fault
>
> Fixed.
I've just grabbed the latest CVS version with the following ChangeLog
entry...
Mon Jul 26 10:13:04 BST 2004 (nj
>
> I had visited the website and not quite understand the implementation
> steps, for your information, I intend to set this up on my firewall
> which is a debian box (woody).
>
> If I am not mistaken, this also, only scans web traffic which will run
> on http port.
>
> Had you ran-across a
Thomas Kinghorn wrote:
Hi List
I have a problem with clamd dying without warning.
Nothing appears in the log files.
You need to put a watchdog script in place that runs out of cron. Clamd has
severe memory management problems and will use all you have - your cron script
should look for two things
How do I tell whitch email they are? Can clam take out the infected
emails with out messing up my inbox?
For the Trash, just empty the Trash, easy he.
A long time ago, for a completely different problem,
I wrote this little prog to split up a netscape mailbox
into separate files names F0, F
ClamAV version : clamscan / ClamAV version devel-20040726
OS : FreeBSD palm.cise.ufl.edu 4.10-PRERELEASE
When scanning a file which appears to have a virus, but not currently
detected by clamav-0.75, clamav crashes. Here's a trace:
#0 0x28077fc0 in cli_bm_sca
On Mon, 26 Jul 2004 11:07:49 -0400
"James F. Hranicky" <[EMAIL PROTECTED]> wrote:
> ClamAV version: clamscan / ClamAV version devel-20040726
> OS: FreeBSD palm.cise.ufl.edu 4.10-PRERELEASE
>
> When scanning a file which appears to hav
On Mon, 26 Jul 2004 11:07:49 -0400
"James F. Hranicky" <[EMAIL PROTECTED]> wrote:
> ClamAV version: clamscan / ClamAV version devel-20040726
> OS: FreeBSD palm.cise.ufl.edu 4.10-PRERELEASE
>
> When scanning a file which appears to hav
I've just upgraded to clamav 0.75 and as a result of running my
testsuite I've found that clamscan no longer detects the W32.Magistr.A
virus. This seems to be an issue with the signature database (I run
freshclam from cron) as when I put back a copy of the signature database
from a couple of w
On Monday 26 Jul 2004 13:53, Sean Cardus wrote:
> >> LibClamAV debug: boundaryStart: line = 'Segmentation Fault
> >
> > Fixed.
>
> Thanks Nigel...
>
> Any idea when the changes will appear on the public CVS servers?
Already done. From the changelog:
Mon Jul 26 10:13:04 BST 2004 (njh)
-
Hi,
I got a suspicious mail this morning which looked very like a virus, and
I'm now receiving reports from a neighbouring institution that they are
getting hit with the same thing. It is rumored to be a new variant of
Bagle, though noting I have picks it up yet.
The mail goes something like this
Hi
I have a couple of question that I hope you can help me with.
Are there going to be released official patches or a new release to correct
the issues that have been mentioned on this list? I wanted to update but
this issue have kept me back. I don't want to use the CVS-version on a
production
- Original Message -
From: "Mike Brodbelt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 26, 2004 11:28 AM
Subject: [Clamav-users] New variant Bagle not being detected?
> Hi,
>
> I got a suspicious mail this morning which looked very like a virus, and
> I'm now receiving
> But I'm still seeing problems, this time the crash happens "further on"
> through processing an email...
Fixed. Please post bugs to [EMAIL PROTECTED] not here.
-Nigel
--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.c
On Mon, 26 Jul 2004 at 17:15:26 +0100, Francis Stevens wrote:
> I've just upgraded to clamav 0.75 and as a result of running my
> testsuite I've found that clamscan no longer detects the W32.Magistr.A
> virus. This seems to be an issue with the signature database (I run
> freshclam from cron) a
I am using the script that come with clamav: contrib/init/RedHat with a
little modification.
There are prepared to star clamd and clamav-milter in that order using
chkconfig.
clamd:# chkconfig: 2345 90 60
clamav-milter:# chkconfig: 2345 91 30
Regards,
Matías.
---
On Mon, 26 Jul 2004 at 17:28:21 +0100, Mike Brodbelt wrote:
>
> I got a suspicious mail this morning which looked very like a virus, and
> I'm now receiving reports from a neighbouring institution that they are
> getting hit with the same thing. It is rumored to be a new variant of
> Bagle, though
On Mon, 26 Jul 2004, Nigel Horne wrote:
> On Monday 26 Jul 2004 09:23, Sean Cardus wrote:
>
> > LibClamAV debug: boundaryStart: line = 'Segmentation Fault
>
> Fixed.
Not fixed. Still segfaulting, downloaded current CVS about
noon EDT.
Unfortunately I can't get the mail because of the segfault
Sean -- TURN OF DEBUG MODE. That solved my crash every 2 seconds problem.
On Mon, 26 Jul 2004, Sean Cardus wrote:
> But I'm still seeing problems, this time the crash happens "further on"
> through processing an email...
>
> LibClamAV debug: in parseEmailBody(nBlobs = 0)
> LibClamAV debug:
For one thing, the web interface for uploading could be A LOT MORE USEFUL by
stating it's current clamscan version, what it detects the upload as,
selected options/config, and signature database - just allowing easier
confirmation of relavent settings.
I've downloaded the 0.75, and upgraded, ensur
Hi,
I've got an email virus sample from this morning. When
I try to submit it, the submission page claims that it
is an already known sample, but clamav (and the online
scanner on the clamav website) doesn't find it.
There's a note in the updates list entry for 423 about
updating to version 0.75;
>
> > Hi,
> >
> > I got a suspicious mail this morning which looked very like a virus,
> > and I'm now receiving reports from a neighbouring institution that
> > they are getting hit with the same thing. It is rumored to be a new
> > variant of Bagle, though noting I have picks it up yet.
> >
> >
I'm seeing this too. I've updated ClamAV to the latest CVS version to see if that
helps.
>>> [EMAIL PROTECTED] 07/26/04 12:48PM >>>
- Original Message -
From: "Mike Brodbelt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 26, 2004 11:28 AM
Subject: [Clamav-users] New vari
> I got a suspicious mail this morning which looked very like a virus, and
> I'm now receiving reports from a neighbouring institution that they are
> getting hit with the same thing. It is rumored to be a new variant of
> Bagle, though noting I have picks it up yet.
There's a new Mydoom out there
On Mon, 26 Jul 2004 10:27:48 -0300 in [EMAIL PROTECTED]
"Mariano Absatz" <[EMAIL PROTECTED]> wrote:
> El 24 Jul 2004 a las 15:09, Steven Stern escribió:
> >
> > Please don't top-post. The easiest way to install clam on RH or
> > Fedora is to use the RPMs at crash-hat. see
> > http://www.clamav.
Mike Brodbelt wrote:
Hi,
I got a suspicious mail this morning which looked very like a virus, and
I'm now receiving reports from a neighbouring institution that they are
getting hit with the same thing. It is rumored to be a new variant of
Bagle, though noting I have picks it up yet.
The mail goes
On Mon, 26 Jul 2004 at 11:30:41 -0700, Marcus Reid wrote:
>
> I've got an email virus sample from this morning. When
> I try to submit it, the submission page claims that it
> is an already known sample, but clamav (and the online
> scanner on the clamav website) doesn't find it.
>
> There's a no
On Mon, 26 Jul 2004 at 11:30:44 -0700, Mitch (WebCob) wrote:
> For one thing, the web interface for uploading could be A LOT MORE USEFUL by
> stating it's current clamscan version, what it detects the upload as,
> selected options/config, and signature database - just allowing easier
> confirmation
On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
> For one thing, the web interface for uploading could be A LOT MORE USEFUL by
> stating it's current clamscan version, what it detects the upload as,
> selected options/config, and signature database - just allowing easier
> confirmation of relavent sett
On Fri, 23 Jul 2004 at 21:53:12 -0400, Lucky Leavell wrote:
> I am using clamav 0.67 on SuSE 9.0 and 0.70 on SuSE 9.1.
>
> I used some previously quarantined messages identified by the 0.67 server
> to test the new 0.70 and found many were also detected but Worm.Gibe.F was
> missed by 0.70. Data
On Mon, 26 Jul 2004, Mike Brodbelt wrote:
> I got a suspicious mail this morning which looked very like a virus, and
> I'm now receiving reports from a neighbouring institution that they are
> getting hit with the same thing. It is rumored to be a new variant of
> Bagle, though noting I have pick
On Mon, 26 Jul 2004 10:27:48 -0300, "Mariano Absatz" <[EMAIL PROTECTED]>
wrote:
>
>Would these RPMs work OK on fc1?
>Or will there be updates for the fc1 releases?
I couldn't tell you. I'm running FC2 with the crash-hat RPM for 0.75. FC1 is
oh so 2003.
--
Steve
Damian Menscher wrote:
On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
For one thing, the web interface for uploading could be A LOT MORE USEFUL by
stating it's current clamscan version, what it detects the upload as,
selected options/config, and signature database - just allowing easier
confirmation o
I'd like to suggest a feature freeze. Watching this list, it appears
there have been stability problems with nearly every release since 0.72
(which is rock solid). But 0.72 doesn't catch the latest viruses. In
fact, it's not clear that even the latest release (0.75) will catch
viruses with uneve
On Mon, 26 Jul 2004 at 14:08:21 -0500, Damian Menscher wrote:
> On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
>
> > For one thing, the web interface for uploading could be A LOT MORE USEFUL by
> > stating it's current clamscan version, what it detects the upload as,
> > selected options/config, and s
Running CVS 20040628 on 2 Solaris email gateways. One was behaving
nicely while the other was using all available ram.
Was manually running freshclam today and noticed digital signatures
wasn't working on the system with the memory usage issues. I recompiled
the source to specifically point to
On Mon, 26 Jul 2004 at 14:08:21 -0500, Damian Menscher wrote:
> On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
>
> I *THINK* it *MIGHT* be because mydoom.o has uneven linelengths in the
> uuencoding. I know that bug was fixed recently, but there's no note in
> the ChangeLog of _when_. So maybe only
I'd like to suggest a feature freeze. Watching this list, it appears
there have been stability problems with nearly every release since 0.72
(which is rock solid). But 0.72 doesn't catch the latest viruses. In
fact, it's not clear that even the latest release (0.75) will catch
viruses with uneve
On Mon, 26 Jul 2004 at 14:08:21 -0500, Damian Menscher wrote:
> On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
>
> I *THINK* it *MIGHT* be because mydoom.o has uneven linelengths in the
> uuencoding. I know that bug was fixed recently, but there's no note in
> the ChangeLog of _when_. So maybe only
> I'd like to suggest a feature freeze. Watching this list, it appears
> there have been stability problems with nearly every release since 0.72
> (which is rock solid). But 0.72 doesn't catch the latest viruses. In
> fact, it's not clear that even the latest release (0.75) will catch
> viruses
I get this when running qmail-scanner 1.22 and
clamscan .75 -
command line clamscan works fine, same cl
arguements...
I have upgraded to .75, I have removed the .cvd files
and manually ran freshclam (I am not sure why the
error calls virus.db - thinking it is a
temp file created)
There is at lea
> I'd like to second that. Those of us depending on clamav to catch stuff
> can't afford to upgrade in the middle of the day for new signatures to
> work. And why don't these new signatures work? Has that interface not
> yet stabilized?
>
> Thanks,
> John
Just wondering...
If signatures come
--- ©hris mckeever <[EMAIL PROTECTED]> wrote:
> I get this when running qmail-scanner 1.22 and
> clamscan .75 -
> command line clamscan works fine, same cl
> arguements...
>
> I have upgraded to .75, I have removed the .cvd
> files
> and manually ran freshclam (I am not sure why the
> error calls
Paul Bijnens wrote:
A.R.S. KA9QLQ Alvin Koffman wrote:
A long time ago, for a completely different problem,
I wrote this little prog to split up a netscape mailbox
into separate files names F0, F1, F2,...
Hay Paul would you mind terribly to answer a couple questions about your
perl s
Hello List,
I recently upgraded from .73 to .75 - I am not seeing any MyDoom being
captured. Is this also a Bagle variant?
Tia,
-B.
---
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your
B> Hello List,
B> I recently upgraded from .73 to .75 - I am not seeing any MyDoom being
B> captured. Is this also a Bagle variant?
MyDoom Variants:
daily.cvd Worm.Mydoom.M (Clam)
daily.cvd Worm.Mydoom.M-upx (Clam)
Regards,
-rafa
B> Tia,
B> -B.
-
On Mon, 26 Jul 2004 at 22:16:42 +0200, Tomasz Papszun wrote:
> On Mon, 26 Jul 2004 at 14:08:21 -0500, Damian Menscher wrote:
> > On Mon, 26 Jul 2004, Mitch (WebCob) wrote:
> >
> > I *THINK* it *MIGHT* be because mydoom.o has uneven linelengths in the
> > uuencoding. I know that bug was fixed rece
Hi,
Good question, ok at the moment my firewall is also acting as router
where we share internet access.
At the moment I had set up my mail server with clamav and it's working fine.
Now the big problem that I have is that some of my users are downloading
some stuff from internet which some of th
Mitch (WebCob) wrote:
For one thing, the web interface for uploading could be A LOT MORE USEFUL by
stating it's current clamscan version, what it detects the upload as,
selected options/config, and signature database - just allowing easier
confirmation of relavent settings.
I've downloaded the 0.75
68 matches
Mail list logo
