Re: [Clamav-users] Pblm with Clamscan on FC3

2004-11-24 Thread Ralf Bosz
> LibClamAV Error: cl_loaddbdir(): Can't open directory Ù/lib/clamav > ERROR: Unable to open file or directory Looks like a problem with permissions. Check the permissions on your lib-directory. You have to make it readable to the world (or at least the user you want to scan with). Greetings, Ral

Re: [Clamav-users] Performance issues on high volume mail server

2004-11-24 Thread Ralf Bosz
Where is your tmp-dir for Amavisd located? Try putting it on tmpfs if it's not. Greetings, Ralf Bosz ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] Performance issues on high volume mail server

2004-11-24 Thread Nigel Horne
> > Server does about 350k messages per day. Whenever the queue is largeish, > > say 40,000+ = mails can take 20mins just to get flushed out of the local > > mail spool. If I turn amavisd off (by commenting out the content_filter > > in postfix main.cf) the server no longer exhibits this, it scream

Re: [Clamav-users] Problems with Netsky and Beagle virus. We installed the clamAV mailter with sendmail

2004-11-24 Thread Nigel Horne
On Wednesday 24 Nov 2004 15:10, Ing. Mónico Briseño C. wrote: > Hi all, > > We installed clamAV mailter with sendmail. However we still have problems > with the Netsky and Baegle virus. > > The following lines are the steps we did to setup the ClamAV mailter with > sendmail. > > Can anybody help us

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Bogusław Brandys
Alvaro Uría wrote: Hello clamav-users, This is my first post in here, and BTW, english is not my first language, so excuse me if i don't express in a good way O:) So... today i've been looking for some info about long filenames not detected by antivirus, but i didn't find any interesting (for my pr

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Bogusław Brandys
Here You have output from clamscan under Windows: D:\temp>clamscan d:\virtest --bell d:\virtest/clam at very long.txt: ClamAV-Test-File FOUND d:\virtest/clam.zip: OK d:\virtest/clam2.exe: OK d:\virtest/eicar2.exe: Eicar-Test-Signature FOUND d:\virtest/eicar3.exe: Eicar-Test-Signature FOUND d

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Tomasz Papszun
On Wed, 24 Nov 2004 at 0:10:36 +0100, Alvaro Ur?a wrote: > [...] > I've got a zip (called mail.zip) which contains a file with a very long > name (called message_text.txt .pif) <-- with a lot of > spaces between '.txt' and '.pif', but clamav didn't detect it :S > > I'm a very newb

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Bogusław Brandys
Bogusław Brandys wrote: Here You have output from clamscan under Windows: D:\temp>clamscan d:\virtest --bell d:\virtest/clam at very long.txt: ClamAV-Test-File FOUND d:\virtest/clam.zip: OK d:\virtest/clam2.exe: OK d:\virtest/eicar2.exe: Eicar-Test-Signature FOUND d:\virtest/eicar3.exe: Eica

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Alvaro Uria
Hi again, On Wed, 24 Nov 2004 10:17:24 +0100 Tomasz Papszun <[EMAIL PROTECTED]> wrote: > Does ClamAV detect a malware if you change the filename to some > "normal", short name?... No? Then nothing shows that there is any > problem with long filenames. I see. I changed its filename to message_te

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Julio Canto
am -v) but ClamAV still doesn't detect it :-S Thank you very much for your help :-) Regards, Alvaro Uría. From VirusTotal (the file you said): ClamWin devel-20041018/20041124 found [Worm.Sober.I] -- Regards, Julio Canto Hispasec Sistemas http://www.hispasec.com (+34) 902 161 025 Parque

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Trog
On Wed, 2004-11-24 at 10:03, Alvaro Uria wrote: > > I've just updated clamav database (with freshclam -v) but ClamAV still > doesn't detect it :-S > > Thank you very much for your help :-) It does here (with the file you made available, which you should remove): $ clamscan mail.zip mail.zip: W

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Tomasz Papszun
On Wed, 24 Nov 2004 at 11:03:56 +0100, Alvaro Uria wrote: > On Wed, 24 Nov 2004 10:17:24 +0100 > Tomasz Papszun <[EMAIL PROTECTED]> wrote: > > > Does ClamAV detect a malware if you change the filename to some > > "normal", short name?... No? Then nothing shows that there is any > > problem with l

Re: [Clamav-users] Zip file with a long filename inside

2004-11-24 Thread Bogusław Brandys
Trog wrote: On Wed, 2004-11-24 at 10:03, Alvaro Uria wrote: I've just updated clamav database (with freshclam -v) but ClamAV still doesn't detect it :-S Thank you very much for your help :-) It does here (with the file you made available, which you should remove): $ clamscan mail.zip mail.zip: Wo

Re: [Clamav-users] [SOLVED] Zip file with a long filename inside

2004-11-24 Thread Alvaro Uria
Hi, On Wed, 24 Nov 2004 11:03:56 +0100 Alvaro Uria <[EMAIL PROTECTED]> wrote: > I've just updated clamav database (with freshclam -v) but ClamAV still > doesn't detect it :-S Sorry about this 'FUD'. I've just tried and it works. (some balanced servers and one of them not actualized because of pe

[Clamav-users] LibClamAV Error: WARNING: not scanned; untested big block size - please report

2004-11-24 Thread irina . moron
Hello, I installed the 0.80 version of ClamAv on Linux RedHat 7.2 and when I scan a directory I'm getting this message: "LibClamAV Error: WARNING: not scanned; untested big block size - please report" I used this command: clamscan -l /var/log/clamav/clamscan.log -d /var/clamav -r /di

Re: [Clamav-users] LibClamAV Error: WARNING: not scanned; untested big block size - please report

2004-11-24 Thread Trog
On Wed, 2004-11-24 at 11:30, [EMAIL PROTECTED] wrote: > "LibClamAV Error: WARNING: not scanned; untested big block size - please > report" > > I used this command: > clamscan -l /var/log/clamav/clamscan.log -d /var/clamav -r /dir > > and the files with problems have ".doc" type. > Th

Re: [Clamav-users] [SOLVED] Zip file with a long filename inside

2004-11-24 Thread Bogusław Brandys
Alvaro Uria wrote: Hi, On Wed, 24 Nov 2004 11:03:56 +0100 Alvaro Uria <[EMAIL PROTECTED]> wrote: I've just updated clamav database (with freshclam -v) but ClamAV still doesn't detect it :-S Sorry about this 'FUD'. I've just tried and it works. (some balanced servers and one of them not actualized

Re: [Clamav-users] Pblm with Clamscan on FC3

2004-11-24 Thread Tomasz Kojm
On Tue, 23 Nov 2004 22:10:56 -0600 Steven Stern <[EMAIL PROTECTED]> wrote: > clamd and clamav-milter seem to be working OK, but I'm running into > this after compiling clam from source for FC3: > > $ clamscan . > LibClamAV Error: cl_loaddbdir(): Can't open directory Ù/lib/clamav > ERROR: Unable t

Re: [Clamav-users] LibClamAV Error: WARNING: not scanned; untested big block size - please report

2004-11-24 Thread irina . moron
I attached a file with this problem. I also tried to open it and I saw that it's impossible. I think the problem comes from that. Thanks, Irina (See attached file: relance.zip) Trog

Re: [Clamav-users] Pblm with Clamscan on FC3

2004-11-24 Thread Steven Stern
On Wed, 24 Nov 2004 09:05:18 +0100, Ralf Bosz <[EMAIL PROTECTED]> wrote: >> LibClamAV Error: cl_loaddbdir(): Can't open directory Ù/lib/clamav >> ERROR: Unable to open file or directory > >Looks like a problem with permissions. Check the permissions on your >lib-directory. You have to make it read

Re: [Clamav-users] Zip module failure

2004-11-24 Thread Anders Herbjørnsen
On Mon, 2004-11-22 at 14:54 -0500, Chris Gauch wrote: >I've had the exact same problems with ZIP MODULE FAILURE >ERRORS appearing intermittently throughout my clamd.log. >The problems also began around that same timeframe >(approx. 2 weeks ago). I haven't done too much in terms of >debugging, etc.

Re: [Clamav-users] Zip module failure

2004-11-24 Thread Anders Herbjørnsen
>As far as I can figure out, from running clamscan on a >large number of zip-files, archives which use the >"deflated" type of compression work ok. Archives with >compression types of "shrunk" or "imploded" will fail. Looking at the sources I can see that the only compression methods supported are

Re: [Clamav-users] BUILD_CLAMD_FALSE

2004-11-24 Thread David Wu
On Tue, 23 Nov 2004, aCaB wrote: > On 11/23/04 09:20, David Wu wrote: > > I am not able to have clamd (and clamav-milter) built on BSD/OS 4.2 from > > 0.8 source, although everything else built and run without problem (after > > fiddling with integer type define). > > > > Found in clamd/Makefile

Re: [Clamav-users] LibClamAV Error: WARNING: not scanned; untested big block size - please report

2004-11-24 Thread Shawn Tayler
On 24-Nov-2004 12:07:05 CET [EMAIL PROTECTED] exclaimed: > > I attached a file with this problem. > I also tried to open it and I saw that it's impossible. I think > the > problem comes from that. > > Thanks, > Irina > > (See attached file: relance.zip) > Interesting, Both the o

[Clamav-users] clamscan 0.80 keeps dying with signal 11

2004-11-24 Thread gregory duchesnes
Hi all, I recently upgraded from clamav 0.75 to 0.80. I seemed to work fine yestaerday bur after analyzing the log i noticed that most of the times clamscan dies with a signal 11. what can i do? my config : Good old Cobalt raq2 with Netbsd 1.6.1 postfix + amavisd-new + clamav + spamassassin her

Re: [Clamav-users] Pblm with Clamscan on FC3

2004-11-24 Thread clamav
On Wed, 24 Nov 2004, Ralf Bosz wrote: > > LibClamAV Error: cl_loaddbdir(): Can't open directory Ù/lib/clamav > > ERROR: Unable to open file or directory Correct me if I'm wrong, but this looks like an uninitialized buffer which should be addressed. -- Eric Wheeler Vice President National Secu

Re: [Clamav-users] clamscan 0.80 keeps dying with signal 11

2004-11-24 Thread Nigel Horne
On Wednesday 24 Nov 2004 5:21 pm, gregory duchesnes wrote: > Hi all, > > I recently upgraded from clamav 0.75 to 0.80. > I seemed to work fine yestaerday bur after analyzing the log i noticed that > most of the times clamscan dies with a signal 11. > > what can i do? What version of zlib do you ha

Re: [Clamav-users] Problems with Netsky and Beagle virus. We installed the clamAV mailter with sendmail

2004-11-24 Thread Damian Menscher
On Wed, 24 Nov 2004, Todd Lyons wrote: Ing. Mónico Briseño C. wanted us to know: Add the following line with the command Cron 43 2,4,6,8,10,12,14,16,18,20,22 * * * root /root/updateclam You can change the long list to */2 and get the same thing. On linux, yes. But not all implementations of cron s

Re: [Clamav-users] Problems with Netsky and Beagle virus. We installed the clamAV mailter with sendmail

2004-11-24 Thread Todd Lyons
Ing. Mónico Briseño C. wanted us to know: >Add the following line with the command Cron >43 2,4,6,8,10,12,14,16,18,20,22 * * * root /root/updateclam You can change the long list to */2 and get the same thing. >Fourth step >Re start the sendmail service and taste the clamAV with the Netsky virus.

Re: [Clamav-users] BUILD_CLAMD_FALSE

2004-11-24 Thread Bogusław Brandys
David Wu wrote: On Tue, 23 Nov 2004, aCaB wrote: On 11/23/04 09:20, David Wu wrote: I am not able to have clamd (and clamav-milter) built on BSD/OS 4.2 from 0.8 source, although everything else built and run without problem (after fiddling with integer type define). Found in clamd/Makefile the fol

[Clamav-users] Thank you to all clamav users, specially to Evan Pierce for your useful help

2004-11-24 Thread Ing. Mónico Briseño C.
Hi ClamAV users community. I know this list is related with ClamAV problems and solutions. However, I think is a list to write "thank you" for your opinions and suggestions. Specially to Evan Pierce for your suggestions about how to fix our ClamAV configuration problem. Today is working very well.

[Clamav-users] mbox files

2004-11-24 Thread Paul Bruce
Hi, I am importing a bunch of mail files from one system to another. I ran clamscan on the mbox files and clamav found some viruses. Okay, that's cool, but my trick is now, which email in the mbox has the virus ? Is there any way of determining that. I scanned the mbox files with clamscan,I tr

[Clamav-users] Virus Tests from www.testvirus.org

2004-11-24 Thread Philip Ershler
I am running the .80 release. Tonight I ran the current set of tests from www.testvirus.org. Tests 4,5,7,8,17, and 19 got through. Any idea what's going on. The last time I ran this suite of tests on the .75 release, I seem to recall it did much better. Thanks for any thoughts, Phil ___

Re: [Clamav-users] Virus Tests from www.testvirus.org

2004-11-24 Thread Tristan Griffiths
Philip Ershler wrote: I am running the .80 release. Tonight I ran the current set of tests from www.testvirus.org. Tests 4,5,7,8,17, and 19 got through. Any idea what's going on. The last time I ran this suite of tests on the .75 release, I seem to recall it did much better. Thanks for any thou

Re: [Clamav-users] mbox files

2004-11-24 Thread James Lick
Paul Bruce wrote: I ran clamscan on the mbox files and clamav found some viruses. Okay, that's cool, but my trick is now, which email in the mbox has the virus ? You can use formail (part of procmail) to unwrap a mailbox into individual messages and pass them through a filter. Read the formail m

Re: [Clamav-users] Pblm with Clamscan on FC3

2004-11-24 Thread Steven Stern
On Wed, 24 Nov 2004 12:06:03 +0100, Tomasz Kojm <[EMAIL PROTECTED]> wrote: >> It looks like the directory name is somehow being munged. What should >> I be looking at to fix this? > >Please run clamscan under valgrind and post the output here. Here's the configure line: ./configure --enable-mil

Re: [Clamav-users] Virus Tests from www.testvirus.org

2004-11-24 Thread Philip Ershler
On Nov 24, 2004, at 9:29 PM, Tristan Griffiths wrote: Philip Ershler wrote: I am running the .80 release. Tonight I ran the current set of tests from www.testvirus.org. Tests 4,5,7,8,17, and 19 got through. Any idea what's going on. The last time I ran this suite of tests on the .75 release, I s

[Clamav-users] Database update question for ClamAV-Milter.

2004-11-24 Thread Wtexpo.com ClamAV
Hello everyone,   I use the latest version 0.80 of ClamAV and set cron to automatically update the virus database. Everything is working fine. However, I found that although my virus database is very up to date, my clamav-milter is still using an old version of database. Below are the datab

Re: [Clamav-users] request for info

2004-11-24 Thread melissad
I am new to this malware work with Linux and have been lurking on thiss list trying to learn how to work with clam. I also know that clamav is for viruses and not web filtering. But I am seeking info here from anyone who might direct me to a web malware subscription or open source database. My c

Re: [Clamav-users] Virus Tests from www.testvirus.org

2004-11-24 Thread George Chelidze
Hello, Philip Ershler wrote: On Nov 24, 2004, at 9:29 PM, Tristan Griffiths wrote: Philip Ershler wrote: I am running the .80 release. Tonight I ran the current set of tests from www.testvirus.org. Tests 4,5,7,8,17, and 19 got through. Any idea what's going on. The last time I ran this suite of

Re: [Clamav-users] Database update question for ClamAV-Milter.

2004-11-24 Thread George Chelidze
Hello, Wtexpo.com ClamAV wrote: Hello everyone, I use the latest version 0.80 of ClamAV and set cron to automatically update the virus database. Everything is working fine. However, I found that although my virus database is very up to date, my clamav-milter is still using an old version of da

Re: [Clamav-users] request for info

2004-11-24 Thread Tomasz Papszun
On Thu, 25 Nov 2004 at 6:11:22 +, melissad wrote: > I am new to this malware work with Linux and have been lurking on thiss > list trying to learn how to work with clam. I also know that clamav is > for viruses and not web filtering. But I am seeking info here from > anyone who might direct