Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:44 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 01:45 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:59 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:14 >>> LLEGO BIEN.

Re:[Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:44 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 01:37 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:52 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:10 >>> LLEGO BIEN.

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:47 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 01:28 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:55 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:13 >>> LLEGO BIEN.

[Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Fajar A. Nugraha
With the signature update for EICAR test virus, clamdwatch.pl no longer works. To use clamav test virus file instead, change the lines # EICAR Test "file" to # ClamAV Test "file" The signature is on file "test" in "test" directory of clamav source. You also need to change the expected respo

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Timo Schöler
hi list, i just added '[EMAIL PROTECTED]' to my list of blocked spammers :) any message from her/him will be silently deleted; it will not be rejected (for god's sake). LLEGO BIEN. Jorge Danussi "[EMAIL PROTECTED]" 09/02/04 02:32 >>> LLEGO BIEN. Jorge Danussi "[EMAIL PROTECTED]" 09/02/04 00:46 >>

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Damian Menscher
On Thu, 2 Sep 2004, Timo Schöler wrote: > i just added '[EMAIL PROTECTED]' to my list of blocked spammers :) Since he doesn't seem to mind responding to his own mail, I spoofed a mail from [EMAIL PROTECTED] to [EMAIL PROTECTED] in hopes of melting his server. Unfortunately it doesn't seem to hav

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Damian Menscher
On Thu, 2 Sep 2004, Fajar A. Nugraha wrote: > With the signature update for EICAR test virus, clamdwatch.pl no longer > works. Huh? clamdwatch.pl seems to be working for me... and what's this about a new signature for eicar? Damian Menscher -- -=#| Physics Grad Student & SysAdmin @ U Illinois

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 03:14 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:32 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 00:46 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:37 >>> LLEGO BIEN.

Re:[Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 03:12 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:32 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 00:36 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:41 >>> LLEGO BIEN.

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Jorge Danussi
LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 03:22 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 02:44 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/02/04 01:45 >>> LLEGO BIEN. Jorge Danussi >>> "[EMAIL PROTECTED]" 09/01/04 23:59 >>> LLEGO BIEN.

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Fajar A. Nugraha
t_file.htm. However, this also means that the file clamdwatch.pl will NOT be detected as EICAR virus (over 128 bytes, extra characters, etc). Using the latest snapshot and database (ClamAV devel-20040902/477/01 Sep 2004 16:20 +0200), clamdwatch.pl complains "Clamd didn't find the EICAR

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Luca Gibelli
Hello Damian Menscher, > Uh oh could one of the list moderators unsubscribe this idiot? He's > responding to his own posts, and infinite loops on mailing lists are > bad. done. Best regards -- Luca Gibelli ([EMAIL PROTECTED]) - http://www.ClamAV.net - A GPL virus scanner PGP Key Finger

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Timo Schöler
i just added '[EMAIL PROTECTED]' to my list of blocked spammers :) Since he doesn't seem to mind responding to his own mail, I spoofed a mail from [EMAIL PROTECTED] to [EMAIL PROTECTED] in hopes of melting his server. Unfortunately it doesn't seem to have worked. Maybe if we each email him a 10

Re: [Clamav-users] Installation of latest dev version

2004-09-02 Thread Fajar A. Nugraha
king resolv.h presence... yes > configure: WARNING: resolv.h: present but cannot be compiled You should be able to compile and run clamav anyway. Just make sure you have clamav devel-20040902 or later, as 20040901 (and some earlier versions) have md5 problem which could cause c

Re: [SPAM] Re: [Clamav-users] OS X Installer and Permissions

2004-09-02 Thread Fajar A. Nugraha
On Wed, 1 Sep 2004 12:11:10 -0700, cH4os <[EMAIL PROTECTED]> wrote: > > Chris Jett <[EMAIL PROTECTED]> wrote: > >> I am working on a "double-click" installer for Mac OS X. That's good :) > >> The only problem I am seeing is when trying to use freshclam. > >> SECURITY WARNING: NO SUPPORT FOR D

Re: [Clamav-users] old database format no longer available

2004-09-02 Thread Julio Canto
Hi there, Formerly, one could consult one of the mirrors with an URL like this, and you could see the signature files: http://clamav.crysys.hu/database/ Now it gives a 'not found' message... what's up with it, did it changed the policy? Greetings, JC

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Scott Call
Thu Sep 2 02:13:01 2004 -> /usr/bin/clamdwatch.pl: Eicar-Test-Signature FOUND Not sure of the exact snapshot version (20040804 I think) with daily 477. I haven't seen the crashes reported either so maybe my code's too old :) -S On Thu, 2 Sep 2004, Fajar A. Nugraha wrote: With the signature updat

Re: [Clamav-users] old database format no longer available

2004-09-02 Thread Fajar A. Nugraha
Julio Canto wrote: Hi there, Formerly, one could consult one of the mirrors with an URL like this, and you could see the signature files: http://clamav.crysys.hu/database/ Now it gives a 'not found' message... what's up with it, did it changed the policy? Lucca already annouced dropped support fo

Re: [Clamav-users] EICAR Test File

2004-09-02 Thread Timo Schöler
fyi, my mailserver discarded another 7 messages since 8:50am: dreyfus: {13} sudo cat /var/log/maillog | grep -c discard 7 dreyfus: {14} annoying... Hello Damian Menscher, Uh oh could one of the list moderators unsubscribe this idiot? He's responding to his own posts, and infinite loops on ma

Re: [Clamav-users] MD5 crashes...

2004-09-02 Thread Andy Fiddaman
* libclamav: replace current MD5 implementation with another one In tests here, the new implementation is about 15% faster than the old one! Andy --- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer

Re: [Clamav-users] old database format no longer available

2004-09-02 Thread Tomasz Papszun
On Thu, 02 Sep 2004 at 10:55:47 +0200, Julio Canto wrote: > Hi there, > Formerly, one could consult one of the mirrors with an URL like this, > and you could see the signature files: > http://clamav.crysys.hu/database/ > Now it gives a 'not found' message... what's up with it, did it changed > th

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Tomasz Kojm
On Thu, 02 Sep 2004 15:17:45 +0700 "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote: > Using the latest snapshot and database (ClamAV devel-20040902/477/01 > Sep 2004 16:20 +0200), > clamdwatch.pl complains > "Clamd didn't find the EICAR pattern. Your virus dat

Re: [Clamav-users] MD5 crashes...

2004-09-02 Thread Tomasz Kojm
On Thu, 2 Sep 2004 09:50:07 + (GMT) Andy Fiddaman <[EMAIL PROTECTED]> wrote: > > * libclamav: replace current MD5 implementation with another one > > In tests here, the new implementation is about 15% faster than the old > one! Yes, it's smaller, cleaner, and faster :-) -- oo.

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Fajar A. Nugraha
Tomasz Kojm wrote: On Thu, 02 Sep 2004 15:17:45 +0700 "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote: Using the latest snapshot and database (ClamAV devel-20040902/477/01 Sep 2004 16:20 +0200), clamdwatch.pl complains "Clamd didn't find the EICAR pattern. Your virus da

Re: [Clamav-users] Warning : clamdwatch.pl incompatible with the "new" EICAR signature

2004-09-02 Thread Everton da Silva Marques
On Thu, Sep 02, 2004 at 01:56:06PM +0700, Fajar A. Nugraha wrote: > With the signature update for EICAR test virus, > clamdwatch.pl no longer works. I have added your suggestions to the modified clamdwatch version I'm running: http://nucleo.freeservers.com/clamdwatch/ I'd like to see the updates

[Clamav-users] ERROR: Can't unlink the socket file /var/run/clamav/clamd.ctl

2004-09-02 Thread Kevin Blackwell
Hello, I've been having problems with clamav. Every Sunday, clamav dies. These are the last messages in the logs every week. ERROR: Can't unlink the socket file /var/run/clamav/clamd.ctl ERROR: Can't unlink the pid file /var/run/clamav/clamd.pid --- Stopped at Sun Aug 29 06:34:34 2004 I search

Re: [Clamav-users] List Down

2004-09-02 Thread Daniel J McDonald
On Wed, 2004-09-01 at 16:11, Jeff Wimmer wrote: > 300 baud telephone cup modem here.then 1200when I got 2400 and the > screen scrolled by faster than I could read, I KNEW I was in tall cotton > then.:-) Right, I remember complaining about our 300 baud modems in high school, talking to

Re: [Clamav-users] ERROR: Can't unlink the socket file /var/run/clamav/clamd.ctl

2004-09-02 Thread Todd Lyons
Kevin Blackwell wanted us to know: >Hello, > I've been having problems with clamav. Every Sunday, clamav dies. >These are the last messages in the logs every week. >ERROR: Can't unlink the socket file /var/run/clamav/clamd.ctl >ERROR: Can't unlink the pid file /var/run/clamav/clamd.pid >--- Sto

[Clamav-users] OverSize.Zip file

2004-09-02 Thread Laura Penhallow
I apologize in advance if this is something easy, but I am at my wits end.  We have a customer that needs to receive rather large zip files from a client of theirs.  Trouble is -- clam keeps classifying the attachment as an OverSized.Zip virus and rejects it.   The zip file is ~8.7 mb contai

Re: [Clamav-users] ERROR: Can't unlink the socket file /var/run/clamav/clamd.ctl

2004-09-02 Thread Tomasz Kojm
On Thu, 02 Sep 2004 15:44:52 -0500 Kevin Blackwell <[EMAIL PROTECTED]> wrote: > Hello, > I've been having problems with clamav. Every Sunday, clamav dies. Sunday is for rest and relaxation and not for virus scanning. I'm sure it doesn't die but just goes out for a walk ;-) -- oo

RE: [Clamav-users] OverSize.Zip file

2004-09-02 Thread Mitch \(WebCob\)
Winzip reports the AVERAGE and clam uses the PEAK value... try bumping up the value to two or three times that amount: ArchiveMaxCompressionRatio from 1000 to test this... the culprit could be an ascii file with a lot of white space that is hugely compressible.   m/ -Original Message-

[Clamav-users] OS X Installer online

2004-09-02 Thread Christopher Jett
I have created an installer for Mac OS X 10.3 that installs ClamAV 0.75.1 as well as GMP 4.1.3. It also creates the clamav user and group for you. It is available here: http://www.jfpsoftware.com/downloads/ClamAV_OSX_Install.sit There is also an optional installer included that creates a Start

[Clamav-users] MyDoom.M Starting to get through

2004-09-02 Thread Scott Ryan
I had an issue with this a while back which was fixed by upgrading to latest devel and then eventually 0.75-1. I run qmail-scanner which in turn calls clamdscan. If i cat the message and pipe through clamdscan manually, clam reports that the message contains the virus myDoom.m, but it is not bei

Re: [Clamav-users] MyDoom.M Starting to get through

2004-09-02 Thread ralf bosz
Are you using the "--mbox" option when manually scanning the mailfiles? On Fri, 3 Sep 2004 07:13:53 +0200, Scott Ryan <[EMAIL PROTECTED]> wrote: > I had an issue with this a while back which was fixed by upgrading to latest > devel and then eventually 0.75-1. > I run qmail-scanner which in turn ca

[Clamav-users] Re: OverSize.Zip file

2004-09-02 Thread Mar Matthias Darin
Laura Penhallow writes: I apologize in advance if this is something easy, but I am at my wits end. We have a customer that needs to receive rather large zip files from a client of theirs. Trouble is -- clam keeps classifying the attachment as an OverSized.Zip virus and rejects it. The zip fi

Re: [Clamav-users] old database format no longer available

2004-09-02 Thread Julio Canto
Lucca already annouced dropped support for old-style viruses.db* (used by clamav <= 0.60). Newer versions (with *.cvd) don't need the /database directory, since *.cvd is located on root dir. As such, the /database was removed from all mirrors. Regards, Fajar Forget my last question :) Thanks! J

[Clamav-users] Virus getting through

2004-09-02 Thread Matjaz Antloga
Virus:   'Troj/WindFind-D' detected in C:\Temp\Temporary Internet Files\Content.IE5\CCLL3WD8\eros[1].exe     File deleted   Sophos has release an IDE for this trojan around 10 August. But it slipped through Squid and Dansguardian with ClamAV. Is it possible that ClamAV is not u