[Clamav-users] clamd logging virus event

2005-01-28 Thread [EMAIL PROTECTED]
Dear all, Bcoz of Worm.Bagle worm, we had to upgrade clamd scan engine from 0.70 to 0.81. Everything go fine after upgraded (and fine tuning of conf file), mail server can block income and outgo mail by using clamd + clamav-milter + sendmail under RH 7.3 But we found that the current ver

Re: [Clamav-users] Re: [Clamav-announce] announcing ClamAV 0.81

2005-01-28 Thread Roux Joubert
On Thu, 2005-01-27 at 13:42 +0100, Tomasz Kojm wrote: > On Thu, 27 Jan 2005 13:37:33 +0100 > Frank Elsner <[EMAIL PROTECTED]> wrote: > > > > WARNING: Your ClamAV installation is OUTDATED - please update > > > immediately! WARNING: Current functionality level = 3, required = 4 > > > > > > This is

Re: [Clamav-users] "ScanStream: read poll failed" error occurs with 0.81 release

2005-01-28 Thread Trog
I guess it's a bug in the perl script you two are using, it doesn't handle high port numbers correctly. -trog On Thu, 2005-01-27 at 13:25 -0800, exo dia wrote: > Thank you Paul, I just made these changes to my clamd.conf, and > restarted clamd. Hopefully this will correct (work around?) the >

Re: [Clamav-users] "ScanStream: read poll failed" error occurs with 0.81 release

2005-01-28 Thread Paul Bijnens
Trog wrote: I guess it's a bug in the perl script you two are using, it doesn't handle high port numbers correctly. That could well be the case, because that system runs perl 5.6.1 (why upgrade production systems when all works fine). A quick check shows 65235 as highest used portnumber (with succe

Re: [Clamav-users] "ScanStream: read poll failed" error occurs with 0.81 release

2005-01-28 Thread Paul Bijnens
Paul Bijnens wrote: Trog wrote: I guess it's a bug in the perl script you two are using, it doesn't handle high port numbers correctly. That could well be the case, because that system runs perl 5.6.1 (why upgrade production systems when all works fine). A quick check shows 65235 as highest used p

[Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Hal Goldfarb
clamdscan uses the clamd daemon to perform scans, and since it runs as user clamav (or the like), it does not have enough permissions to scan calling user's directories if they are protected. For instance, my .tvtime subdirectory in my home will be scanned by clamscan, but will generate erro

[Clamav-users] scanning through links?

2005-01-28 Thread Hal Goldfarb
Is there a way to prevent clamscan and clamdscan from recursing through links? When the program gets to a link it cannot traverse (due to permissions restrictions, see my previous mail), it issues an error. However, the program seems to be keeping track of which directories it has visited (pe

Re: [Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Niek
On 1/28/2005 11:25 AM +0100, Hal Goldfarb wrote: clamdscan uses the clamd daemon to perform scans, and since it runs as user clamav (or the like), it does not have enough permissions to scan calling user's directories if they are protected. For instance, my .tvtime subdirectory in my home will

Re: [Clamav-users] clamav-milter without clamd

2005-01-28 Thread Steven Stern
On Fri, 28 Jan 2005 06:16:01 -, "Nigel Horne" <[EMAIL PROTECTED]> wrote: >There is a thread within clamav-milter which wakes up from time to time >and reloads the database when freshclam has been run. Thanks. Exactly what I needed to know. Suggestion for .82: Have freshclam notify clamav-mi

RE: [Clamav-users] clamav-milter without clamd

2005-01-28 Thread Nigel Horne
> Suggestion for .82: Have freshclam notify clamav-milter as it > now notifies That's already in the TODO list. > Steve -Nigel ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Hal Goldfarb
On Friday 28 January 2005 03:31, Niek wrote: > On 1/28/2005 11:25 AM +0100, Hal Goldfarb wrote: > > clamdscan uses the clamd daemon to perform scans, and since it runs as > > user clamav (or the like), it does not have enough permissions to scan > > calling user's directories if they are protected.

RE: [Clamav-users] clamav-milter without clamd

2005-01-28 Thread Damian Menscher
On Fri, 28 Jan 2005, Nigel Horne wrote: It's a great idea to have clamav-milter do it's own thing. BUT, what is its relationship with freshclam? In the clamav-milter -> clamd, you could be assured that clamd would always be aware of updates installed by freshclam. How does this work in the all mi

[Clamav-users] clamav-milter 0.81 on Mandrake

2005-01-28 Thread David Meuleman
I used Bill Randle's RPMs on neocat.org to upgrade from version 0.80 yesterday (thank you for updating those Bill).  One thing I noticed after I upgraded was when I went to start the clamav-milter service I received the following error: LibClamAV Error: cli_cvdload():  Can't create temporary d

Re: [Clamav-users] clamav-milter 0.81 on Mandrake

2005-01-28 Thread Nigel Horne
On Friday 28 Jan 2005 14:18, David Meuleman wrote: > Probably the best fix is to have clamav-milter also check for the > TemporaryDirectory directive in clamd.conf or to add a command-line > option to give it that value. If that's not an option, at least this > message will hopefully be found

Re: [Clamav-users] hardware requirements for 250,000 messages

2005-01-28 Thread Andrew P. Kaplan
>>250,000 messages per minute, hour, day, week, month? the answer rather >> dramatically affects the discussion. Yikes, sorry about that. It's 250,000 messages a day. And I would like to put the virus scanner on a second box. [EMAIL PROTECTED] wrote: At 05:51 PM 1/27/2005, you wrote: I plan to

Re: [Clamav-users] hardware requirements for 250,000 messages

2005-01-28 Thread Andrew P. Kaplan
regardless however, i'm a strong proponent of decentralization, not consolidation. my MX's do no processing to speak of besides being a place for incoming messages to queue. those messages feed to a dedicated spamassassin/clamav server. from there they go to the delivery server, where customer

[Clamav-users] Problems with Solaris

2005-01-28 Thread Jorge Valdes
Hi all, I have had to apply this small patch to both 0.80 and 0.81 so that everything would work as expected on Solaris-9. I have had no problems running "stock" versions on linux. diff -rc clamav-0.81-orig/shared/output.c clamav-0.81/shared/output.c *** clamav-0.81-orig/shared/output.c

Re: [Clamav-users] "ScanStream: read poll failed" error occurs with 0.81 release

2005-01-28 Thread exo dia
> Just finished my coffee. It is not perl, but the OS itself. > > Just doing: "nc -vvv -l -p 61000" gives "address already in use", > and that up to port 65234. But there is no process really using it. > I think that range was used by the NAT-module in ipchains. > > That machine was planned to

[Clamav-users] Strange date in headers

2005-01-28 Thread Joe Polk
Can someone tell me what the Jan 17 stands for in this clip from a header? This mail came in on the 21st so I assume this is maybe an installation date? X-Virus-Scanned: ClamAV 0.80/671/Mon Jan 17 09:16:31 2005 clamav-milter version 0.80j on foo.foo.com -- <> ___

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Brian Morrison
On Fri, 28 Jan 2005 11:55:49 -0400 in [EMAIL PROTECTED] "Joe Polk" <[EMAIL PROTECTED]> wrote: > Can someone tell me what the Jan 17 stands for in this clip from a > header? This mail came in on the 21st so I assume this is maybe an > installation date? > > X-Virus-Scanned: ClamAV 0.80/671/Mon Jan

[Clamav-users] Milter: data, reject=451 4.3.2 Please try again later

2005-01-28 Thread Cesar Gonzalez
I'm getting this on my maillog, any ideas? It runs for a while, and for no aparent reason starts doing that, stoping clamd and milter and restarting them fixes the problem, but it's rather annoying doing several times a day. OS FreeBSD 4.11-Stable clamav-milter version 0.80ff ClamAV version devel

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Nigel Horne
On Friday 28 Jan 2005 15:55, Joe Polk wrote: > Can someone tell me what the Jan 17 stands for in this clip from a header? > This mail came in on the 21st so I assume this is maybe an installation date? > > X-Virus-Scanned: ClamAV 0.80/671/Mon Jan 17 09:16:31 2005 clamav-milter > version 0.80j on f

Re: [Clamav-users] Milter: data, reject=451 4.3.2 Please try again later

2005-01-28 Thread Nigel Horne
Try version 0.81. If it's still not working report back to here, this time with your sendmail.mc, clamd.conf and clamav-milter start options. On Friday 28 Jan 2005 16:11, Cesar Gonzalez wrote: > > I'm getting this on my maillog, any ideas? It runs for a while, and for no > aparent reason starts d

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Jim Maul
Nigel Horne wrote: On Friday 28 Jan 2005 15:55, Joe Polk wrote: Can someone tell me what the Jan 17 stands for in this clip from a header? This mail came in on the 21st so I assume this is maybe an installation date? X-Virus-Scanned: ClamAV 0.80/671/Mon Jan 17 09:16:31 2005 clamav-milter version 0.

Re: [Clamav-users] Milter: data, reject=451 4.3.2 Please try again later

2005-01-28 Thread Brian Morrison
On Fri, 28 Jan 2005 10:11:50 -0600 in [EMAIL PROTECTED] "Cesar Gonzalez" <[EMAIL PROTECTED]> wrote: > clamav-milter version 0.80ff > ClamAV version devel-20050126 I'm pretty sure that there is a later clamav-milter than that ( I don't use it myself, but I assume that 0.80j is later than 0.80ff)

RE: [Clamav-users] Milter: data, reject=451 4.3.2 Please try againlater

2005-01-28 Thread Nigel Horne
> From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Brian > Morrison > I'm pretty sure that there is a later clamav-milter than that ( I don't > use it myself, but I assume that 0.80j is later than 0.80ff Wrong. When I reached 'z' I went to 'aa' > Brian Morrison

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Tomasz Kojm
On Fri, 28 Jan 2005 11:17:54 -0500 Jim Maul <[EMAIL PROTECTED]> wrote: > Thats interesting. > > [EMAIL PROTECTED] clamav]# clamscan -V > ClamAV 0.81/690/Fri Jan 28 07:09:45 2005 > > I didnt get to work until 9am today. What happened at 7:09am this > morning?? Rather a simple puzzle... --

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread N Fung
--- Brian Morrison <[EMAIL PROTECTED]> wrote: > On Fri, 28 Jan 2005 11:55:49 -0400 in > [EMAIL PROTECTED] "Joe Polk" > <[EMAIL PROTECTED]> > wrote: > > > Can someone tell me what the Jan 17 stands for in this > clip from a > > header? This mail came in on the 21st so I assume this > is maybe an

Re: [Clamav-users] Milter: data, reject=451 4.3.2 Please try againlater

2005-01-28 Thread Brian Morrison
On Fri, 28 Jan 2005 16:22:45 - in [EMAIL PROTECTED] "Nigel Horne" <[EMAIL PROTECTED]> wrote: > Wrong. When I reached 'z' I went to 'aa' OK, as I said I don't use it here so I had not followed it that closely. -- Brian Morrison bdm at fenrir dot org dot uk GnuPG key ID DE32E5C5 - http://

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Jim Maul
Tomasz Kojm wrote: On Fri, 28 Jan 2005 11:17:54 -0500 Jim Maul <[EMAIL PROTECTED]> wrote: Thats interesting. [EMAIL PROTECTED] clamav]# clamscan -V ClamAV 0.81/690/Fri Jan 28 07:09:45 2005 I didnt get to work until 9am today. What happened at 7:09am this morning?? Rather a simple puzzle... Heh.

[Clamav-users] Milter: data, reject=451 4.3.2 Please try again later

2005-01-28 Thread Rick Pim
Cesar Gonzalez writes: > > I'm getting this on my maillog, any ideas? It runs for a while, and for no > aparent reason starts doing that, stoping clamd and milter and restarting > them fixes the problem, but it's rather annoying doing several times a day. it may be a complete coincidence, but

Re: [Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Tomasz Kojm
On Fri, 28 Jan 2005 03:25:21 -0700 Hal Goldfarb <[EMAIL PROTECTED]> wrote: > > clamdscan uses the clamd daemon to perform scans, and since it runs as > user clamav (or the like), it does not have enough permissions to scan > calling user's directories if they are protected. > > For instance, m

Re: [Clamav-users] Strange date in headers

2005-01-28 Thread Ken Jones
> Tomasz Kojm wrote: >> On Fri, 28 Jan 2005 11:17:54 -0500 >> Jim Maul <[EMAIL PROTECTED]> wrote: >> >> >>>Thats interesting. >>> >>>[EMAIL PROTECTED] clamav]# clamscan -V >>>ClamAV 0.81/690/Fri Jan 28 07:09:45 2005 >>> >>>I didnt get to work until 9am today. What happened at 7:09am this >>>morni

Re: [Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Stephen Gran
On Fri, Jan 28, 2005 at 06:40:32AM -0700, Hal Goldfarb said: > On Friday 28 January 2005 03:31, Niek wrote: > > On 1/28/2005 11:25 AM +0100, Hal Goldfarb wrote: > > > clamdscan uses the clamd daemon to perform scans, and since it runs as > > > user clamav (or the like), it does not have enough perm

[Clamav-users] freshclam complaining

2005-01-28 Thread John
Hi all, I running Debian sarge and this morning freshclam started complaining in it's logs about ClamAV being outdated, Current functionality level=3, required=4. I don't see any new updates for sarge, any idea when they will be avail? Or is there another solution? TIA... John _

Re: [Clamav-users] freshclam complaining

2005-01-28 Thread Stephen Gran
On Fri, Jan 28, 2005 at 01:33:11PM -0500, John said: > Hi all, > > I running Debian sarge and this morning freshclam started complaining in > it's logs about ClamAV being outdated, Current functionality level=3, > required=4. I don't see any new updates for sarge, any idea when they > will be a

Re: [Clamav-users] freshclam complaining

2005-01-28 Thread John
Stephen Gran wrote: On Fri, Jan 28, 2005 at 01:33:11PM -0500, John said: Hi all, I running Debian sarge and this morning freshclam started complaining in it's logs about ClamAV being outdated, Current functionality level=3, required=4. I don't see any new updates for sarge, any idea when they wi

RE: [Clamav-users] freshclam complaining

2005-01-28 Thread Jeff Lanzarotta
Any idea on when version 8.1 for Mandrake 10.0 will be available? Regards, -Jeff -Original Message- From: John [mailto:[EMAIL PROTECTED] Sent: Friday, January 28, 2005 1:33 PM To: clamav-users@lists.clamav.net Subject: [Clamav-users] freshclam complaining Hi all, I running Debian sarg

Re: [Clamav-users] hardware requirements for 250,000 messages

2005-01-28 Thread Craig Green
Andrew P. Kaplan wrote: . Can you give me a hint as to how you do this. I like the idea of having multiple redundant spamclam boxes. We run a similar setup to Paul's. We have a pair of incoming SMTP servers servers running Sendmail with two milters: clamav-milter and milter-ahead. Milter-ahead

RE: [Clamav-users] freshclam complaining

2005-01-28 Thread Daniel J McDonald
On Fri, 2005-01-28 at 14:06 -0500, Jeff Lanzarotta wrote: > Any idea on when version 8.1 for Mandrake 10.0 will be available? Mandrake 10.1 has released it, as well as 10.2 Beta 1. you can grab the SRPM from ftp://neocat.org/pub/SRPMS/clamav-0.81-1010.1mdk.src.rpm and then do: rpmbuild --rebuild

Re: [Clamav-users] hardware requirements for 250,000 messages

2005-01-28 Thread Adam Tauno Williams
> >I would like to see what other people with similiar volume are doing > If you drop spamassassin, then a 2-way xeon or opteron with 2GB memory > will do. > If you can get non-perl replacement for amavisd (e.g. use something like > exim + exiscan + clamd, > or sendmail + clamav-milter + clamd, o

[Clamav-users] freshclam not updating, on Debian Linux

2005-01-28 Thread Jim
I am using clamav and I have done an "apt-get dist-upgrade clamav" but when I run freshclam I get "Your ClamAV installation is OUTDATED - please update immediately! WARNING: Current functionality level = 3, required = 4" below is the output from "dpkg -l clamav" and the the output from "freshclam"

Re: [Clamav-users] Phishing Questions

2005-01-28 Thread Robert G. Werner
jef moskot wrote: On Thu, 27 Jan 2005, Jim Maul wrote: What if the plumber and the mechanic work on it together? ;) What if the electrician goes to night school to learn ornithology? ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Or be

Re: [Clamav-users] clamdscan does not scan protected directories

2005-01-28 Thread Hal Goldfarb
On Friday 28 January 2005 09:57, Stephen Gran wrote: > On Fri, Jan 28, 2005 at 06:40:32AM -0700, Hal Goldfarb said: > > On Friday 28 January 2005 03:31, Niek wrote: > > > On 1/28/2005 11:25 AM +0100, Hal Goldfarb wrote: > > > > clamdscan uses the clamd daemon to perform scans, and since it runs > >

Re: [Clamav-users] freshclam not updating, on Debian Linux

2005-01-28 Thread John
Jim, You can go here to pick up the update: http://people.debian.org/~sgran or wait a couple of days till it migrates from sid to sarge. John Jim wrote: I am using clamav and I have done an "apt-get dist-upgrade clamav" but when I run freshclam I get "Your ClamAV installation is OUTDATED - please u