[Clamav-users] Big problem (Malformed database) after update to 0.96

2010-04-13 Thread Sim
# freshclam -V ClamAV 0.96 # freshclam ClamAV update process started at Tue Apr 13 10:57:24 2010 Downloading main.cvd [100%] main.cvd updated (version: 52, sigs: 704727, f-level: 44, builder: sven) Downloading daily.cvd [100%] daily.cvd updated (version: 10736, sigs: 51024, f-level: 51, builder: c

[Clamav-users] Big problem (Malformed database) after update to 0.96

2010-04-13 Thread G.W. Haywood
Hi there, On Tue, 13 Apr 2010 Sim wrote: > # /usr/sbin/clamd > LibClamAV Error: cli_cvdload: Corrupted CVD header > LibClamAV Error: Can't load /usr/local/share/clamav/daily.cvd: > Malformed database > ERROR: Malformed database > Closing the main socket. It shouldn't happen at all, but it seems

[Clamav-users] create signature for ELF

2010-04-13 Thread Andre Hübner
Hello, iam looking for the best way to create a signature on ELF Binaries. Currently i use a md5-checksum but i dont know this will be enough. Small changes on file results in different checksum. Fore text-files i did some hex-dumps on special fileparts which works good, but seems not to be a pr

Re: [Clamav-users] create signature for ELF

2010-04-13 Thread Török Edwin
On 04/13/2010 01:51 PM, Andre Hübner wrote: Hello, iam looking for the best way to create a signature on ELF Binaries. Type 6 .ndb signatures, see signatures.pdf. Currently i use a md5-checksum but i dont know this will be enough. Small changes on file results in different checksum. Fore tex

Re: [Clamav-users] HostID

2010-04-13 Thread Chris
On Tue, 2010-04-13 at 09:50 +0300, Török Edwin wrote: > On 04/13/2010 01:57 AM, Chris wrote: > > I'd like to set this up for my home system, what format does a HostID > > need to be in? > > You get the HostID by following the steps described here: > http://lurker.clamav.net/message/20100322.160036

Re: [Clamav-users] HostID

2010-04-13 Thread Török Edwin
On 04/13/2010 02:17 PM, Chris wrote: On Tue, 2010-04-13 at 09:50 +0300, Török Edwin wrote: On 04/13/2010 01:57 AM, Chris wrote: I'd like to set this up for my home system, what format does a HostID need to be in? You get the HostID by following the steps described here: http://lurker.clamav.n

[Clamav-users] ClamAV 0.96, Solaris 10, and max open fds

2010-04-13 Thread Scott . Larnach
Hello, I tested ClamAV 0.96 on a relatively recent Solaris 10 / i86pc machine and all was well. Bringing it up on a production machine running a somewhat older version of Solaris 10 (also i86pc), clamd gives the warning: WARNING: Solaris only supports 256 open files for 32-bit processes, you

Re: [Clamav-users] ClamAV 0.96, Solaris 10, and max open fds

2010-04-13 Thread Andy Fiddaman
On Tue, 13 Apr 2010, scott.larn...@ed.ac.uk wrote: ; Hello, ; ; I tested ClamAV 0.96 on a relatively recent Solaris 10 / i86pc machine and all ; was well. Bringing it up on a production machine running a somewhat older ; version of Solaris 10 (also i86pc), clamd gives the warning: ; ; WARNING: So

Re: [Clamav-users] ClamAV 0.96, Solaris 10, and max open fds

2010-04-13 Thread Török Edwin
On 04/13/2010 03:53 PM, Andy Fiddaman wrote: On Tue, 13 Apr 2010, scott.larn...@ed.ac.uk wrote: ; Hello, ; ; I tested ClamAV 0.96 on a relatively recent Solaris 10 / i86pc machine and all ; was well. Bringing it up on a production machine running a somewhat older ; version of Solaris 10 (also i

Re: [Clamav-users] ClamAV 0.96, Solaris 10, and max open fds

2010-04-13 Thread Scott . Larnach
On Tue, 13 Apr 2010, Andy Fiddaman wrote: ... In general the 32-bit stdio routines do not support file descriptors > 255. Ah... I did vaguely wonder about the call to enable_extended_FILE_stdio(). Thanks for that very clear explanation. I'll go for building a 64-bit binary. Regards. Scott

Re: [Clamav-users] create signature for ELF

2010-04-13 Thread Andre Hübner
Sorry, i read digest version and answering creates a new unthreaded mail... Hello, Create a signature for some unique code sequence specific to it for example. yes, i do this for textfiles of all kindes but how to find unique code sequence in a binary file. i think editing/copy/paste with bi

Re: [Clamav-users] create signature for ELF

2010-04-13 Thread Török Edwin
On 04/13/2010 05:22 PM, Andre Hübner wrote: Sorry, i read digest version and answering creates a new unthreaded mail... Hello, Create a signature for some unique code sequence specific to it for example. yes, i do this for textfiles of all kindes but how to find unique code sequence in a bin

[Clamav-users] ClamAV for Windows Feedback requested

2010-04-13 Thread Matt Watchinski
Well its been a little over a month since the launch of ClamAV for Windows and we have a little over 22,000 users currently running it. As we plan for future releases and additional integration with LibClamAV we'd like to gather a little feedback from the community on how people are using it and wh

[Clamav-users] Odd FP signature

2010-04-13 Thread Dennis Peterson
One of my customers in Eastern Washington just got some mail blocked because of this non-Clamav pattern: :INetMsg.SpamDomain-2w.gonzaga_edu:4:*:(2e|2f|40|20|3c|5f)676f6e7a6167612e656475(27|22|20|2f|3d|5f|3e|0a|0d) No way I'm telling the Zag's they're not getting their mail :) Point being is it

[Clamav-users] clamd memory usage

2010-04-13 Thread Chris
I'll admit I'm not too smart when it comes to how much memory an app is supposed to use but it seems to me that since I installed .96 on my Mandriva 2010 system it's using an excessive amount. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 834 clamav 20 0 375m 344m 54

Re: [Clamav-users] HostID

2010-04-13 Thread Chris
On Tue, 2010-04-13 at 14:23 +0300, Török Edwin wrote: > On 04/13/2010 02:17 PM, Chris wrote: > > On Tue, 2010-04-13 at 09:50 +0300, Török Edwin wrote: > >> On 04/13/2010 01:57 AM, Chris wrote: > >>> I'd like to set this up for my home system, what format does a HostID > >>> need to be in? > >> > >>

Re: [Clamav-users] clamd memory usage

2010-04-13 Thread Jim Preston
Chris wrote: I'll admit I'm not too smart when it comes to how much memory an app is supposed to use but it seems to me that since I installed .96 on my Mandriva 2010 system it's using an excessive amount. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 834 clamav 20

Re: [Clamav-users] clamd memory usage

2010-04-13 Thread Jim Preston
Jim Preston wrote: Chris wrote: I'll admit I'm not too smart when it comes to how much memory an app is supposed to use but it seems to me that since I installed .96 on my Mandriva 2010 system it's using an excessive amount. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

Re: [Clamav-users] Odd FP signature

2010-04-13 Thread Bill Landry
On 4/13/2010 6:38 PM, Dennis Peterson wrote: One of my customers in Eastern Washington just got some mail blocked because of this non-Clamav pattern: :INetMsg.SpamDomain-2w.gonzaga_edu:4:*:(2e|2f|40|20|3c|5f)676f6e7a6167612e656475(27|22|20|2f|3d|5f|3e|0a|0d) The signature has been removed a