Re: [Clamav-users] Virus not detected on Linux/MacOSX

2008-09-22 Thread Moray Henderson (ICT)
>> > ./clamscan/.libs/clamscan file.exe >> > Linux Wally 2.6.18-53.1.6.el5 #1 SMP Wed Jan 23 11:28:47 EST 2008 >> > x86_64 x86_64 x86_64 GNU/Linux >> > MD5(file.exe)= e7e7dc7981a4089cdcb42d32247dc6e0 >> > ClamAV 0.94/8284/Thu Sep 18 18:54:57 2008 >> > file.exe: OK >> > >> > --- SCAN

[Clamav-users] Email header parsing

2008-09-22 Thread Benoit Schmid
Good morning, I have local signatures (local.ndb) define. One of my rules is not allways matched because the UA or MTA may generate/modify different headers. I have defined a match on: application/zip; name="testdu28.zip" But emails are sometimes generated with: ...application/zip; name="testd

[Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Carlos Williams
I am still unable to run /usr/bin/freshclam. This happened to me before and then it eventually started working again for a little but now has come back for some reason. I really want to understand and figure this out. Here is what I get and also nothing appears in the logs from what I can tell: m

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Brandon Perry
your logs are owned by amavis? On Mon, Sep 22, 2008 at 10:08 AM, Carlos Williams <[EMAIL PROTECTED]>wrote: > I am still unable to run /usr/bin/freshclam. This happened to me > before and then it eventually started working again for a little but > now has come back for some reason. I really want t

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread James Kosin
Brandon Perry wrote: > your logs are owned by amavis? > > On Mon, Sep 22, 2008 at 10:08 AM, Carlos Williams <[EMAIL PROTECTED]>wrote: > >> mail:/var/log/clamav# ls -l >> total 112 >> -rw-r- 1 amavis adm 3401 2008-09-22 10:29 clamav.log >> -rw-r- 1 amavis adm 23918 2008-09-21 06:25 clamav

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Carlos Williams
On Mon, Sep 22, 2008 at 12:06 PM, James Kosin <[EMAIL PROTECTED]> wrote: > Brandon Perry wrote: >> your logs are owned by amavis? I followed this guide for how to configure permissions on Debian for Clamav. http://www200.pair.com/mecham/spam/clamav-amavisd-new.html Did I do something wrong or mi

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Brandon Perry
ClamAV can't write to the logs because they don't have the permissions. You missed this part it looks like: *The text illustrated above must match the LocalSocket parameter you found in clamd.conf.* Edit amavisd.conf to match what you found in clamd.conf if it is different. This "clamd.ctl" is the

Re: [Clamav-users] How important are file extensions?

2008-09-22 Thread Roberto Ullfig
Alejandro Pedraza wrote: >>> Does clamav have a mechanism to find out a file is an archive without >>> relying on its extension? For example does it know it has to unzip a >>> zipped file even if its extension was changed to a random one >>> different than .zip ? >>> >> ClamAV doesn't rely o

Re: [Clamav-users] How important are file extensions?

2008-09-22 Thread David F. Skoll
Roberto Ullfig wrote: > Somewhat off topic but does someone here know if there's a standard file > extension that represents a null program. What I mean is that we rename > some attachment suffixes to .txt but this causes some problems with some > applications. We'd like to rename the attachmen

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Carlos Williams
On Mon, Sep 22, 2008 at 12:56 PM, Brandon Perry <[EMAIL PROTECTED]> wrote: > ClamAV can't write to the logs because they don't have the permissions. You > missed this part it looks like: > *The text illustrated above must match the LocalSocket parameter you found > in clamd.conf.* > Edit amavisd.co

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Carlos Williams
Hmmm, something is very strange here because with no changes made to any config or permissions modified, I am now able to run 'freshclam' with out any errors as I was having in my 1st example. All I simply did was 'restart' the daemon running 'freshclam': mail:/etc# /etc/init.d/clamav-freshclam re

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Brandon Perry
What might be happening is two different apps with two different permissions are writing to the files. when the second app writes to the files, its permissions keep the first app (freshclam) from writing to the logs. On Mon, Sep 22, 2008 at 12:16 PM, Carlos Williams <[EMAIL PROTECTED]>wrote: > Hmm

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Carlos Williams
On Mon, Sep 22, 2008 at 1:24 PM, Brandon Perry <[EMAIL PROTECTED]> wrote: > What might be happening is two different apps with two different permissions > are writing to the files. when the second app writes to the files, its > permissions keep the first app (freshclam) from writing to the logs. S

Re: [Clamav-users] Unable To Run Freshclam...still

2008-09-22 Thread Brandon Perry
try taking amavis out of the picture and see what happens. On Mon, Sep 22, 2008 at 12:33 PM, Carlos Williams <[EMAIL PROTECTED]>wrote: > On Mon, Sep 22, 2008 at 1:24 PM, Brandon Perry > <[EMAIL PROTECTED]> wrote: > > What might be happening is two different apps with two different > permissions >

Re: [Clamav-users] Virus not detected on Linux/MacOSX

2008-09-22 Thread Eric Rostetter
Quoting fchan <[EMAIL PROTECTED]>: > Remember not everyone that uses clamav is not an expert so for They don't have to be an expert, they just have to read and configure the configuration file for their needs. > someone that is new to clamav thinks that every file that went > through clamav woul

Re: [Clamav-users] How important are file extensions?

2008-09-22 Thread SM
At 09:59 22-09-2008, Roberto Ullfig wrote: >Somewhat off topic but does someone here know if there's a standard file >extension that represents a null program. What I mean is that we rename >some attachment suffixes to .txt but this causes some problems with some >applications. We'd like to rename

Re: [Clamav-users] How important are file extensions?

2008-09-22 Thread Charles Gregory
On Mon, 22 Sep 2008, SM wrote: > At 09:59 22-09-2008, Roberto Ullfig wrote: > >Somewhat off topic but does someone here know if there's a standard file > >extension that represents a null program. > File associations is a Microsoft concept. There are a few reserved > names for devices but no stan