Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread sys...@ra-schaal.de
Am 13.09.2011 20:49, schrieb Bowie Bailey: > On 9/13/2011 1:18 PM, sys...@ra-schaal.de wrote: >> Am 13.09.2011 18:01, schrieb Al Varnell: >>> On Sep 13, 2011, at 8:15 AM, Dan wrote: >>> Yet more failure on 88.198.67.125, this morning. This one is a double. >>> I was going to wait a few more

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Al Varnell
On 9/14/11 12:29 AM, "sys...@ra-schaal.de" wrote: > i made some changes to the firewall. if it works be now, please mail me > as soon as possible. > I was able to connect via my browser. I forced an update by pulling out my bytecode.cld and it successfully downloaded it from your mirror. So wh

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Noel Jones
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/14/2011 2:29 AM, sys...@ra-schaal.de wrote: > i made some changes to the firewall. if it works be now, please > mail me as soon as possible. I started getting successful updates from 88.198.67.125 a couple hours after you posted this, and port 8

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Christopher X. Candreva
On Wed, 14 Sep 2011, Dan wrote: > At 7:44 AM -0500 9/14/2011, Noel Jones wrote: > > On 9/14/2011 2:29 AM, sys...@ra-schaal.de wrote: > > > i made some changes to the firewall. if it works be now, please > > > mail me as soon as possible. > > > > I started getting successful updates from 88.198.

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Bryan Burke
> Does your dig use the host table? Mine does not. Same with nslookup. > I can't imagine why they would, in fact. Yea, I had to use "getent hosts db.us.clamav.net" to make sure the /etc/hosts entry was working. -- Bryan Burke IT Administrator Department of Electrical Engineering and Computer Sc

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Dan
At 7:44 AM -0500 9/14/2011, Noel Jones wrote: On 9/14/2011 2:29 AM, sys...@ra-schaal.de wrote: i made some changes to the firewall. if it works be now, please > mail me as soon as possible. I started getting successful updates from 88.198.67.125 a couple hours after you posted this, and port

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Steve Basford
> On Wed, 14 Sep 2011, Dan wrote: > http://www.downforeveryoneorjustme.com/88.198.67.125 > > Says it's up. Received responses: 53 Ok 5 Fail http://host-tracker.com/check_res_ajx/8730391-0/ Cheers, Steve Sanesecurity ___ Help us build a comprehensive

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Nathan Gibbs
On 9/13/2011 10:29 PM, Al Varnell wrote: > I was trying to say that using this command: > > freshclam --stdout --quiet --no-warnings > --log=/usr/local/clamXav/share/clamav/freshclam.log > > I can determine the IP address of a successful update in the last line, e.g. > > Database updated (10388

[clamav-users] CCEE 0.97.2 Patch Set Release

2011-09-14 Thread Nathan Gibbs
Clamav Common Execution Environment patch set. CCEE is a patch set to the ClamAV source that does the following: 1. Implements fixes for bugs 1754 and 2727. 2. Adds additional functionality to the software. CCEE 0.97.2 Features. Code Cleanup. Derived from the ClamAV 0.97.2 Codebase

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Dan
At 12:36 PM -0400 9/13/2011, Bryan Burke wrote: > Noone has suggested "maximum". The issue is that the mirrors are so overloaded that it's often taking freshclam an excessive amount of time to do its thing, because of the time-outs / connection failures. No big deal if it's the update run i

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Dennis Peterson
On 9/14/11 12:29 AM, sys...@ra-schaal.de wrote: if you can´t connect to 88.198.67.125, you should fall back to 46.4.61.241. it seems, that freshclam won´t use the second ip. nslookup clamav.akxnet.de Server: 127.0.0.1 Address:127.0.0.1#53 Name: clamav.akxnet.de Address: 88.19

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Dan
At 12:36 PM -0400 9/13/2011, Bryan Burke wrote: > Noone has suggested "maximum". The issue is that the mirrors are so overloaded that it's often taking freshclam an excessive amount of time to do its thing, because of the time-outs / connection failures. No big deal if it's the update run i

[clamav-users] ClamAV fails to detect PDF /Launch actions

2011-09-14 Thread Dimitrov, Atanas
Hi, I encountered an issue where ClamAV doesn't detect malicious payload in PDFs stored in a Launch Action. (PDF File Format Section 8.5.3 Action Types see "Launch Actions") Here's an example: 8 0 obj << /Type /Action /S /Launch /Win << /F (cmd.exe) /P ( BLAH.. you get the point ...)

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread sys...@ra-schaal.de
Am 14.09.2011 18:15, schrieb Dennis Peterson: > expectation is that a reliable service is running only at the IP in the > authorative DNS server at clamav.net and that IP is 88.198.67.125. Your > depending on 46.4.61.241 as a fallback server is bad architecture. I told them a few months ago, and

[clamav-users] Yet Another US Mirror Issue-Solved

2011-09-14 Thread Al Varnell
It's been almost twenty-four hours since the Firewall was fixed, so I thought I'd take this opportunity to thank everybody involved, both for backing me up when there was much doubt and for offering useful suggestions and obviously to Florian for solving at his part of the issue. Hopefully US user

Re: [clamav-users] Yet Another US Mirror Issue

2011-09-14 Thread Jim Preston
On 09/14/2011 09:20 AM, Dan wrote: At 12:36 PM -0400 9/13/2011, Bryan Burke wrote: > Noone has suggested "maximum". The issue is that the mirrors are so overloaded that it's often taking freshclam an excessive amount of time to do its thing, because of the time-outs / connection failures. N