Re: [Clamav-users] minor clamav-milter patch

2004-08-05 Thread Nigel Horne
On Wednesday 04 Aug 2004 07:17, Damian Menscher wrote: > static const char *localAddresses[] = { > "^127\\.0\\.0\\.1$", > "^192\\.168\\.[0-9]*\\.[0-9]*$", > "^172\\.1[6-9]\\.[0-9]*\\.[0-9]*$", >

Re: [Clamav-users] Template question

2004-08-05 Thread Nigel Horne
On Saturday 24 Jul 2004 18:52, Dan O'Brien wrote: > Additional information: > Virus: %v > Daemon Name:{daemon_name} 0.75f now has improved template file handling. Thanks to you and to "Sergey Y. Afonin" <[EMAIL PROTECTED]> for pushing me on this. -Nigel -- Nigel Horne. Arranger, Composer

RE: [Clamav-users] ClamAV devel, and email formats (was: Re: 0.75.1 not detecting many more viruses :-( )

2004-08-05 Thread Dan Kendall
Jesse wrote: > 2.) I'm thinking of writing a general purpose Email module for the OCaml > programming language. However, I think the ClamAV project is PROOF > that there are more ways to package email than any one person can > count. ASCII, Unicode, MIME, TNEF, UPX, Base64, etc... the

[Clamav-users] [PATCH] catch Mydoom.M "binary fragments"

2004-08-05 Thread Trog
The attached patch for clamav-0.75.1 will catch the files sent by Mydoom.M that have been reported as "binary fragments". They will get reported as Mydoom.M.log Thanks, -trog --- clamav-0.75.1.dist/libclamav/scanners.c 2004-06-29 22:58:37.0 +0100 +++ clamav-0.75.1/libclamav/scanners.c 20

[Clamav-users] Warning messages are queued after upgraded to 0.75.1

2004-08-05 Thread Martin Chan
Dear all, After upgraded to 0.75.1, the warning messages "Virus intercepted" are queued on the mqueue, is it configurable in clamav.conf? Thanks, Martin Chan --- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com

RE: [Clamav-users] Warning messages are queued after upgraded to 0.75.1

2004-08-05 Thread Nigel Horne
> Dear all, > > After upgraded to 0.75.1, the warning messages "Virus intercepted" are > queued on the mqueue, is it configurable in clamav.conf? Turn off scanning of local messages. > Thanks, > Martin Chan -Nigel --- This SF.Net email is sp

Re: [Clamav-users] Amavis-new and Clamd

2004-08-05 Thread Cody Dabb
On Wed, 2004-08-04 at 23:01, Jeff Ramsey wrote: > On Aug 4, 2004, at 7:48 PM, <[EMAIL PROTECTED]> wrote: > > > > > - Original Message - > > From: "Cody Dabb" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, August 04, 2004 4:11 PM > > Subject: [Clamav-users] Amavis-new

Re: [Clamav-users] Template question

2004-08-05 Thread Dan O'Brien
Nigel Horne <[EMAIL PROTECTED]>wrote: > 0.75f now has improved template file handling. Most excellent!! I'll give it a whirl when the next tarball is available. Dan --- This SF.Net email is sponsored by OSTG. Have you noticed the changes on

Re: [Clamav-users] [PATCH] catch Mydoom.M "binary fragments"

2004-08-05 Thread Charlie Watts
On Thu, 5 Aug 2004, Trog wrote: > The attached patch for clamav-0.75.1 will catch the files sent by > Mydoom.M that have been reported as "binary fragments". > > They will get reported as Mydoom.M.log Is this a one-time patch-against-0.75.1 or something that will show up in the development tree?

Re: [Clamav-users] Segmentation Fault in clamav-milter

2004-08-05 Thread Robert Schmidt
On Thu, 2004-07-08 at 18:27, Nigel Horne wrote: > On Thursday 08 Jul 2004 18:43, Robert Schmidt wrote: > > This is happening pretty frequently, 2 or 3 times per day. I upgraded > > from .70 to .74 to see if it made any difference. It didn't. > > Is 0.74b any better? > Thanks for your help in the

[Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Ryan Moore
Over the past few days I've had a few reports of a virus getting through, and while the sig database has that virus listed (sigtool -l), I don't see any blocks in my messages log. I'm still running a slightly older version of clamav on most my boxes (0.72) since there were some issues with the

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Damian Menscher
On Thu, 5 Aug 2004, Ryan Moore wrote: > Over the past few days I've had a few reports of a virus getting > through, and while the sig database has that virus listed (sigtool -l), > I don't see any blocks in my messages log. I'm still running a slightly > older version of clamav on most my boxes (0

Re: [Clamav-users] [PATCH] catch Mydoom.M "binary fragments"

2004-08-05 Thread Robert
On 5 Aug 2004, at 09:09, Trog wrote: The attached patch for clamav-0.75.1 will catch the files sent by Mydoom.M that have been reported as "binary fragments". They will get reported as Mydoom.M.log Thanks, -trog This 'MIGHT' be a dumb question, but then I might be dumb !! How would one apply this

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Jeremy Kitchen
On Thursday 05 August 2004 12:46 pm, Ryan Moore wrote: > Such that if freshclam downloads a signature and if the > signature has a 'engine version requirement' or some attribute that can > be compared against the installed engine, if the installed engine isn't > newer, give a nasty warning in the l

[Clamav-users] Re: Warning messages are queued after upgraded to 0.75.1

2004-08-05 Thread Matias Lopez Bergero
Nigel Horne wrote: Dear all, After upgraded to 0.75.1, the warning messages "Virus intercepted" are queued on the mqueue, is it configurable in clamav.conf? Turn off scanning of local messages. But...that means that an infected machine on the LAN will be able to send emails contained viruses usin

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Ryan Moore
Jeremy Kitchen wrote: On Thursday 05 August 2004 12:46 pm, Ryan Moore wrote: Such that if freshclam downloads a signature and if the signature has a 'engine version requirement' or some attribute that can be compared against the installed engine, if the installed engine isn't newer, give a nasty wa

RE: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Mitch \(WebCob\)
This is predicated on the developers of the database incrementing the "functionality level" when they make changes like this. I'm still not sure I get it, but there seems to be some resistance to doing this consistantly. Some changes in detection seem to make it into CVS, and I think future versi

Re: [Clamav-users] [PATCH] catch Mydoom.M "binary fragments"

2004-08-05 Thread Robert
On 5 Aug 2004, at 20:29, Robert wrote: On 5 Aug 2004, at 09:09, Trog wrote: The attached patch for clamav-0.75.1 will catch the files sent by Mydoom.M that have been reported as "binary fragments". They will get reported as Mydoom.M.log Thanks, -trog This 'MIGHT' be a dumb question, but then I mi

Re: [Clamav-users] Re: Warning messages are queued after upgraded to 0.75.1

2004-08-05 Thread Nigel Horne
On Thursday 05 Aug 2004 21:41, Matias Lopez Bergero wrote: > Nigel Horne wrote: > >>Dear all, > >> > >>After upgraded to 0.75.1, the warning messages "Virus intercepted" are > >>queued on the mqueue, is it configurable in clamav.conf? > > > > > > Turn off scanning of local messages. > > > > But

[Clamav-users] Another upgrade question.

2004-08-05 Thread Ken Goods
I'm running Sendmail, Mailscanner, Spamassasin, and Clamav (0.70rc-1). I would like to upgrade Clamav. Tried yum but it continues to tell me there are no updates available. So on to plan two. I'm going to install from the RPMs but wasn't exactly sure of the process. This is my plan. 1. Stop Mailsc

[Clamav-users] ClamAV-20040805

2004-08-05 Thread Tomasz Kojm
Dear users, the development version of ClamAV is mature enough to start using it instead of 0.7x stable releases. Please give it a try and report all bugs to [EMAIL PROTECTED] Thank you ! http://www.clamav.net/snapshot/clamav-20040805.tar.gz The above snapshot includes a new, memory efficient

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Thomas Lamy
Mitch (WebCob) wrote: Jeremy Kitchen wrote: On Thursday 05 August 2004 12:46 pm, Ryan Moore wrote: Such that if freshclam downloads a signature and if the signature has a 'engine version requirement' or some attribute that can be compared against the installed engine, if the installed engine isn't

Re: [Clamav-users] Another upgrade question.

2004-08-05 Thread Thomas Lamy
Ken Goods wrote: I'm running Sendmail, Mailscanner, Spamassasin, and Clamav (0.70rc-1). I would like to upgrade Clamav. Tried yum but it continues to tell me there are no updates available. So on to plan two. I'm going to install from the RPMs but wasn't exactly sure of the process. This is my plan

Re: [Clamav-users] Another upgrade question.

2004-08-05 Thread Peter Bonivart
Ken Goods wrote: I'm running Sendmail, Mailscanner, Spamassasin, and Clamav (0.70rc-1). I would like to upgrade Clamav. Tried yum but it continues to tell me there are no updates available. So on to plan two. I'm going to install from the RPMs but wasn't exactly sure of the process. This is my plan

Re: [Clamav-users] failure with 0.75.1 (was Re: success report on 0.75.1)

2004-08-05 Thread Todd Lyons
Christopher McCrory wanted us to know: >Once per week we send a newsletter out to many people. This takes ~10 >hours as it's not very optimized. One message per receipent, not one >message -> many. >clamd keeps failing over >I added "--dont-scan-on-error " to the clamav-milter args, the >freque

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Tomasz Kojm
On Fri, 06 Aug 2004 00:08:55 +0200 Thomas Lamy <[EMAIL PROTECTED]> wrote: > IIRC freshclam doesn't even update the local database if your local > installation has a too small "functionality level". I guess it was Even if the f-level is smaller than required one freshclam still attempts to upda

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Rick Macdougall
Tomasz Kojm wrote: Dear users, the development version of ClamAV is mature enough to start using it instead of 0.7x stable releases. Please give it a try and report all bugs to [EMAIL PROTECTED] Thank you ! http://www.clamav.net/snapshot/clamav-20040805.tar.gz The above snapshot includes a new

RE: [Clamav-users] Another upgrade question.

2004-08-05 Thread Ken Goods
Thomas Lamy scribbled on Thursday, August 05, 2004 3:24 PM: > Ken Goods wrote: > >> I'm running Sendmail, Mailscanner, Spamassasin, and Clamav >> (0.70rc-1). I would like to upgrade Clamav. Tried yum but it >> continues to tell me there are no updates available. So on to plan >> two. I'm going to

RE: [Clamav-users] Another upgrade question.

2004-08-05 Thread Ken Goods
Peter Bonivart scribbled on Thursday, August 05, 2004 3:23 PM: > Ken Goods wrote: >> I'm running Sendmail, Mailscanner, Spamassasin, and Clamav >> (0.70rc-1). I would like to upgrade Clamav. Tried yum but it >> continues to tell me there are no updates available. So on to plan >> two. I'm going to

Re: [Clamav-users] Another upgrade question.

2004-08-05 Thread Peter Bonivart
Ken Goods wrote: Thanks Peter! More great tips! Especially the freshclam.conf/clamav.conf explanation. I know I read somewhere that it was only used by clamd but forgot until you mentioned it. I've been reading too much lately... It's mentioned at the top of the file but since it's named in such a

Re: [Clamav-users] Clamav Engine upgrades?

2004-08-05 Thread Thomas Lamy
Tomasz Kojm wrote: On Fri, 06 Aug 2004 00:08:55 +0200 Thomas Lamy <[EMAIL PROTECTED]> wrote: IIRC freshclam doesn't even update the local database if your local installation has a too small "functionality level". I guess it was Even if the f-level is smaller than required one freshclam still a

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread René Bellora
> > > Tomasz Kojm wrote: > > > Dear users, > > > > the development version of ClamAV is mature enough to start using it > > instead of 0.7x stable releases. Please give it a try and report all > > bugs to [EMAIL PROTECTED] Thank you ! > > &g

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Jeremy Kitchen
On Thursday 05 August 2004 07:44 pm, René Bellora wrote: > > > bugs to [EMAIL PROTECTED] Thank you ! > I'm testing against old viruses, it seems to miss JS.FortNight.B. Same > files, with 0.75 and same signatures are caught *cough* -Jeremy -- Jeremy Kitchen ++ Systems Administrator ++ Inter7 I

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Rick Macdougall
Jeremy Kitchen wrote: On Thursday 05 August 2004 07:44 pm, René Bellora wrote: bugs to [EMAIL PROTECTED] Thank you ! I'm testing against old viruses, it seems to miss JS.FortNight.B. Same files, with 0.75 and same signatures are caught *cough* Hi, What's that mean Jeremy ? Regards, Rick

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Fajar A. Nugraha
Rick Macdougall wrote: Jeremy Kitchen wrote: On Thursday 05 August 2004 07:44 pm, René Bellora wrote: bugs to [EMAIL PROTECTED] Thank you ! I'm testing against old viruses, it seems to miss JS.FortNight.B. Same files, with 0.75 and same signatures are caught *cough* Hi, What's that mean Jeremy

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Rick Macdougall
Fajar A. Nugraha wrote: Rick Macdougall wrote: Jeremy Kitchen wrote: On Thursday 05 August 2004 07:44 pm, René Bellora wrote: bugs to [EMAIL PROTECTED] Thank you ! I'm testing against old viruses, it seems to miss JS.FortNight.B. Same files, with 0.75 and same signatures are caught *cough* Hi, W

Re: [Clamav-users] ClamAV-20040805

2004-08-05 Thread Damian Menscher
On Fri, 6 Aug 2004, Fajar A. Nugraha wrote: > Rick Macdougall wrote: > > Jeremy Kitchen wrote: > >> On Thursday 05 August 2004 07:44 pm, René Bellora wrote: > >> > > bugs to [EMAIL PROTECTED] Thank you ! > >> > >>> I'm testing against old viruses, it seems to miss JS.FortNight.B. Same > >>> fil