Re: [Clamav-users] File type signature for PDF document not loaded (required f-level: 55)

2010-09-09 Thread Török Edwin
On Tue, 7 Sep 2010 17:34:15 -0400 Jason Parsons wrote: > [r...@c1-delltest2 temp]# egrep ':54$' daily.* > daily.ftm:1:*:255044462d??2e*737461727478726566*2525454f46:PDF:CL_TYPE_ANY:CL_TYPE_PDF:54:54 > daily.ftm:1:*:257064662d??2e*737461727478726566*2525454f46:PDF:CL_TYPE_ANY:CL_TYPE_PDF:54:54 > d

[Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread ANANT S ATHAVALE
Dear List, I have got a complaint from one of our users that, a genuine mail has got identified as virus: Heuristics.Phishing.Email.SpoofedDomain, with internal reference code as ' 02103-11/QCZxxtAvePMy'.  I don't know what exactly is the meaning of internal reference code. We are not quaranti

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread Török Edwin
On Thu, 09 Sep 2010 14:35:40 +0530 ANANT S ATHAVALE wrote: > Dear List, > > I have got a complaint from one of our users that, a genuine mail has > got identified as virus: Heuristics.Phishing.Email.SpoofedDomain, > with internal reference code as ' 02103-11/QCZxxtAvePMy'.  That reference code

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread G.W. Haywood
Hi there, On Thu, 9 Sep 2010 ANANT S ATHAVALE wrote: > I have got a complaint from one of our users that, a genuine mail > has got identified as virus: > ... > But, it looks like this is a false positive as the recipient has > confirmed with the bank that such mails are being sent. I personally

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread ANANT S ATHAVALE
- Message from edwinto...@gmail.com - Date: Thu, 9 Sep 2010 12:46:40 +0300 From: Török Edwin Subject: Re: [Clamav-users] Fwd: Important mail marked as spam To: ClamAV users ML Cc: a...@isac.gov.in, RAKESH KUMAR , RAJIV RATAN CHETWANI On Thu, 09 Sep 2010 14

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread Jerry
On Thu, 9 Sep 2010 11:10:37 +0100 (BST) G.W. Haywood articulated: > I personally would never accept nor rely on any email which claimed > to be from a bank. I know too much about email, and about banks. > > I reject mail which uses the word 'bank' anywhere in the greeting, > the envelope addres

Re: [Clamav-users] recipient notification

2010-09-09 Thread aCaB
Chris wrote: > So, I wrote a nice little script, and it would work fine too, except > that the 4th argument (the "destination", which I took to mean the > "recipient") is always "UNKNOWN". So, the message always fails. Maybe > destination isn't supposed to mean recipient -- if that is so, what do

[Clamav-users] Fw: Fwd: Important mail marked as spam

2010-09-09 Thread Jose Alf.
Dear List, >That reference code is not coming from ClamAV, it has no reference >codes. Its probably some reference code of some 3rdparty app that uses >ClamAV for scanning. This is an amavisd-new reference code. I've seen false positives with genuine messages from other banks. I would be good t

Re: [Clamav-users] recipient notification

2010-09-09 Thread Chris
I think you're doing it right. You only need to configure sendmail to fill in those macroes, which, by default, it leaves blank. It's generally only a matter of adding the following line to your .cf: define(`confMILTER_MACROS_EOM', `{msg_id}, {mail_addr}, {rcpt_addr}, i') HtH, aCaB Thanks for

Re: [Clamav-users] recipient notification

2010-09-09 Thread aCaB
Chris wrote: > I am not sure I follow your logic here though, because I thought it was > clamav-milter that passes those 7 arguments (not sendmail), all of which > look good, except the 4th: "destination". That's correct. But clamav-milter is just a stupid streaming bridge which knows nothing abou

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread JD
On 09/09/2010 05:05 AM, Jerry wrote: On Thu, 9 Sep 2010 11:10:37 +0100 (BST) G.W. Haywood articulated: I personally would never accept nor rely on any email which claimed to be from a bank. I know too much about email, and about banks. I reject mail which uses the word 'bank' anywhere in t

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread Bill Landry
On 9/9/2010 10:13 AM, JD wrote: > > > On 09/09/2010 05:05 AM, Jerry wrote: >> On Thu, 9 Sep 2010 11:10:37 +0100 (BST) >> G.W. Haywood articulated: >> >>> I personally would never accept nor rely on any email which claimed >>> to be from a bank. I know too much about email, and about banks. >>>

Re: [Clamav-users] Latest daily file crashes ClamAV on PowerPC Macintosh

2010-09-09 Thread Mark Allan
On 17 Jun 2010, at 5:24 pm, Larry Stone wrote: On Thu, 17 Jun 2010, Török Edwin wrote: Here is a new patch for Mac OS X/PPC: https://wwws.clamav.net/bugzilla/attachment.cgi?id=1333 It reverts my previous patch, and applies my patch from LLVM PR5201 (which isn't finished, but appears to work

Re: [Clamav-users] Latest daily file crashes ClamAV on PowerPC Macintosh

2010-09-09 Thread Török Edwin
On Thu, 9 Sep 2010 19:01:28 +0100 Mark Allan wrote: > > On 17 Jun 2010, at 5:24 pm, Larry Stone wrote: > > > On Thu, 17 Jun 2010, Török Edwin wrote: > > > >> Here is a new patch for Mac OS X/PPC: > >> https://wwws.clamav.net/bugzilla/attachment.cgi?id=1333 > >> > >> It reverts my previous patch

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread Jerry
On Thu, 09 Sep 2010 10:13:03 -0700 JD articulated: > On 09/09/2010 05:05 AM, Jerry wrote: > > On Thu, 9 Sep 2010 11:10:37 +0100 (BST) > > G.W. Haywood articulated: > > > >> I personally would never accept nor rely on any email which claimed > >> to be from a bank. I know too much about email, a

Re: [Clamav-users] Latest daily file crashes ClamAV on PowerPC Macintosh

2010-09-09 Thread Mark Allan
On 9 Sep 2010, at 8:11 pm, Török Edwin wrote: On Thu, 9 Sep 2010 19:01:28 +0100, Mark Allan wrote: On 17 Jun 2010, at 5:24 pm, Larry Stone wrote: On Thu, 17 Jun 2010, Török Edwin wrote: Here is a new patch for Mac OS X/PPC: https://wwws.clamav.net/bugzilla/attachment.cgi?id=1333 It reverts m

Re: [Clamav-users] Latest daily file crashes ClamAV on PowerPC Macintosh

2010-09-09 Thread Mark Allan
On 9 Sep 2010, at 9:53 pm, Mark Allan wrote: On 9 Sep 2010, at 8:11 pm, Török Edwin wrote: On Thu, 9 Sep 2010 19:01:28 +0100, Mark Allan wrote: On 17 Jun 2010, at 5:24 pm, Larry Stone wrote: On Thu, 17 Jun 2010, Török Edwin wrote: Here is a new patch for Mac OS X/PPC: https://wwws.clamav.net

Re: [Clamav-users] Fwd: Important mail marked as spam

2010-09-09 Thread JD
On 09/09/2010 01:32 PM, Jerry wrote: On Thu, 09 Sep 2010 10:13:03 -0700 JD articulated: On 09/09/2010 05:05 AM, Jerry wrote: On Thu, 9 Sep 2010 11:10:37 +0100 (BST) G.W. Haywood articulated: I personally would never accept nor rely on any email which claimed to be from a bank. I know t

Re: [Clamav-users] recipient notification

2010-09-09 Thread Nathan Gibbs
* Chris wrote: > Hello. > > I have recently upgraded to clamav 0.96, and I noticed that there have > been some major changes to clamav-milter. > > I am trying to get recipient notification to work with clamav-milter, > but I fail to see how this is done. I have looked at the man page, and > the

Re: [Clamav-users] Latest daily file crashes ClamAV on PowerPC Macintosh

2010-09-09 Thread Török Edwin
On Thu, 9 Sep 2010 22:17:07 +0100 Mark Allan wrote: > > On 9 Sep 2010, at 9:53 pm, Mark Allan wrote: > > On 9 Sep 2010, at 8:11 pm, Török Edwin wrote: > >> On Thu, 9 Sep 2010 19:01:28 +0100, Mark Allan wrote: > >>> On 17 Jun 2010, at 5:24 pm, Larry Stone wrote: > On Thu, 17 Jun 2010, Török