[clamav-users] HTML.CVE_2012_1526-3 necessary?

Hello, is a signatur like this HTML.CVE_2012_1526-3 really needed? HTML.CVE_2012_1526-3:3:*:7374796c653d{-256}6d617267696e3a{-20}2d(31|32|33|34|35|36|37|38|39)(30|31|32|33|34|35|36|37|38|39)(30|31|32|33|34|35|36|37|38|39)(30|31|32|33|34|35|36|37|38|39)656d This signature blocks html-pages with

[clamav-users] TeamViewer_Setup_de.exe -> TeamViewer_Setup_de.exe

Hello, currently the official download of TeamViewer_Setup_de.exe ( http://www.teamviewer.com/de/download/windows.aspx ) seems to be infected. My local linux clamav-scanner founds Win.Adware.Wajam Is this a real malware or FP? If i scanning this file at virustotal.com, then no single scanner

[Clamav-users] clamav 0.96 -> huge /usr/lib/libclamav.so.6.1.2

Hello, try to package the new clamav 0.96. compiling works but my /usr/lib/libclamav.so.6.1.2 gets really huge, size is 73MB /usr/lib/libclamav.so.6.0.5 of version 0.95.3 just was 2MB This is my configure-line: ./configure --sysconfdir=/etc --prefix=/usr --libdir=%_libdir --with-user=nobody -

Re: [Clamav-users] clamav 0.96 -> huge /usr/lib/libclamav.so.6.1.2 (T?r?k Edwin)

Hello, Remove -g from CXXFLAGS, or run strip on the resulting libclamav.so. i removed the -g and size of resulting /usr/lib/libclamav.so.6.1.2 is ~13MB Perhaps I should add something to the upgrade notes about this. hmm, yes the whole part "-O2 -g -m32 -march=i586 -mtune=i686 -fmessage-len

[Clamav-users] create signature for ELF

Hello, iam looking for the best way to create a signature on ELF Binaries. Currently i use a md5-checksum but i dont know this will be enough. Small changes on file results in different checksum. Fore text-files i did some hex-dumps on special fileparts which works good, but seems not to be a pr

Re: [Clamav-users] create signature for ELF

Sorry, i read digest version and answering creates a new unthreaded mail... Hello, Create a signature for some unique code sequence specific to it for example. yes, i do this for textfiles of all kindes but how to find unique code sequence in a binary file. i think editing/copy/paste with bi

Re: [Clamav-users] create signature for ELF

Hello, So why don't you just submit the sample at clamav.net/sendvirus? ok, i did that yesterday but iam afraid this is not the kind of mailware which will included in official virus-db. the other thing is that i already sometimes submitted a virussample but never got feedback. i have to be

Re: [Clamav-users] can?t compile 0.96.3

Hello, Message: 5 Date: Tue, 21 Sep 2010 10:03:44 +0300 From: T?r?k Edwin Subject: Re: [Clamav-users] can?t compile 0.96.3 To: clamav-users@lists.clamav.net Message-ID: <20100921100344.133d4...@deb0> Content-Type: text/plain; charset=US-ASCII On Tue, 21 Sep 2010 08:26:01 +0200 Florian Schaal

Re: [Clamav-users] can?t compile 0.96.3

Hello, ___ I am seeing the same hang here on openSuSE 10.2(x86-64). This system has bzip2 1.0.5 installed from source also. I don't mind the warning, it's the hang that prevents configure from finishing. I am not too worried as I have clamav 0.96.2

[clamav-users] Virus in archive

Hello, have a problem here. i do a download of file owncloud-4.5.0.tar.bz2 http://owncloud.org/support/install/ when scanning this archive-file by clamscan a virus is found: PHP.Exploit.CVE_2011_4153-2 After unpacking the file and rescanning structure then no virus is found. Whats that? a virus i

[Clamav-users] proftpd-mod_clamav

Hello List, i think my question is not very complicated, but i could not find the solution. I use proftpd proftpd-1.3.0a and clamav-0.91.2 Clam is scanning bad files and is deleting them, but there is no message to the ftp-client. The Client always says successful, this is my problem. In my prof

[Clamav-users] false alarm with uploading js from wordpress

Hello List, i use newest clamav 0.92.1 over mod_clamav for proftpd. I upload files from wordpress 2.5 and the files: /wordpress/wp-includes/js/jquery/interface.js /wordpress/wp-includes/js/jquery/jquery.js are shown as infected by Trojan.Downloader.JS.Agent-1 by mod_clamav and clamscan Thes

[Clamav-users] false alert - Trojan.FakeAlert-566

Hi List, we use clamav-0.94/mod_clamav for proftpd and my users have problems uploading files since 03 Sep 2008 . http://lurker.clamav.net/message/20080903.182645.120cafee.en.html A lot of files are found with Trojan.FakeAlert-566. I scanned this files with virscan.org with different engines an

[Clamav-users] clamav - own signatures

Hello, sometimes clamav is to rigorous and "kills" some uploaded php-files where no malware can be found. but in this case i want to stop a specific directmailer (spam) with russian origin from being uploaded. File was submitted already but seems not to be included in official malware. Now i did

[Clamav-users] Feature Request Scanlist

Hi, during practical work with webspace/virus etc. i missed a function in clamscan to scan files which were given by list in file. Often after a Hackattack by ftp/upload etc. a lot of files with alike date of creation are found in filesystem. Sometimes it is not necessary to scan whole filesyste

[Clamav-users] mod_clamav for proftpd and clamav 0.95, tcpsocket

Hello, for a long time i use the combination proftpd --> mod_clamav --> clamav Now i have a problem with current 0.95 mod_clamav talks to clamd using tcpsocket port 3310 part of my proftpd.conf: ClamAV on ClamServer 127.0.0.1 ClamPort 3310 clamav is listening

Re: [Clamav-users] mod_clamav for proftpd and clamav 0.95, tcpsocket

Hello, > I think the problem is mod_clamav, it is using the old SESSION command. > Why are you using 0.10 version of mod_clamav? The website has 0.22, and > it doesn't seem to use the SESSION command anymore. version 0.22 belonsg to mod_clamav for apache, i talk about proftpd where 0.10 seems