[Clamav-users] What's W32.Netsky.P@mm!enc?

2004-06-13 Thread Arthur Kerpician
Hi all, I've been using for quite a while Clamav on a qmail smarthost which delivers mail to a local exchange server. Before using Clamav, the exchange server was protected by NAV for Exchange and I left it working just for backup scanning. From time to time (once on every 3-4 days) NAV gives a

Re: [Clamav-users] What's W32.Netsky.P@mm!enc?

2004-06-14 Thread Arthur Kerpician
Tris Forster wrote: Hi Clam should be detecting Netsky.P as Somefool.P (crazy virus alias stuff). The definition has been in the db for months so it looks like you have a configuration issue. Is the infected file buried in a zip or similar? Tris On Sun, 2004-06-13 at 10:10, Arthur Kerpician

[Clamav-users] Mydoom.M

2004-07-30 Thread Arthur Kerpician
Hi, 1. I'm running ClamAV-0.73 on RH9 machine (qmail) and made all the updates, including daily 429. Anyway, it seems that mydoom.m is bypassing ClamAV since 2 of my servers (same config) didn't send any notification to the admin e-mail regarding the worm. After one of the servers i have NAV fo

Re: [Clamav-users] Mydoom.M

2004-07-31 Thread Arthur Kerpician
Daniel J McDonald wrote: On Fri, 2004-07-30 at 14:27, Arthur Kerpician wrote: Hi, 1. I'm running ClamAV-0.73 on RH9 machine (qmail) and made all the updates, 0.73 doesn't support mangled MIME encoding. That was added in 0.75. You probably want to upgrade to 0.75.1 at this po

[Clamav-users] Ignoring option -r

2004-08-10 Thread Arthur Kerpician
Hi all, Is anybody getting this message in the mail notifications? ---clamdscan results --- WARNING: Ignoring option -r: please edit clamav.conf instead. --- Couldn't find anything related to thet -r switch. I start clamd only with -c to point to the configuration file. Thanks for any ideas. Arthu

Re: [Clamav-users] Ignoring option -r

2004-08-10 Thread Arthur Kerpician
Tomasz Papszun wrote: On Tue, 10 Aug 2004 at 11:42:16 +0300, Arthur Kerpician wrote: Hi all, Is anybody getting this message in the mail notifications? ---clamdscan results --- ^ WARNING: Ignoring option -r: please edit clamav.conf instead. --- Couldn't find anything re

[Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Arthur Kerpician
Hi all, Some updates on what I've posted a few weeks ago: That time I was complaining about SomeFool.P passing through my ClamAV server and getting caught by NAV on the Exchange server (as [EMAIL PROTECTED]). I was encouraged to update to the latest ClamAV, which I did and now I'm running versio

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Arthur Kerpician
Damian Menscher wrote: On Wed, 11 Aug 2004, Arthur Kerpician wrote: Still, about 4-5 times a day, NAV detects [EMAIL PROTECTED] I repeat, NAV/Exchange server is behind my RH Linux/ClamAV machine which is supposed to do all filtering (AV/Spam) until it passes the mails to the Exchange. I saved a

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-11 Thread Arthur Kerpician
Damian Menscher wrote: On Wed, 11 Aug 2004, Arthur Kerpician wrote: Still, about 4-5 times a day, NAV detects [EMAIL PROTECTED] I repeat, NAV/Exchange server is behind my RH Linux/ClamAV machine which is supposed to do all filtering (AV/Spam) until it passes the mails to the Exchange. I saved a

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-12 Thread Arthur Kerpician
Todd Lyons wrote: Brian Morrison wanted us to know: >Received: from localhost [127.0.0.1] by backup.ccina.ro with >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 >+0300 This is the last line of Received headers, so it never says exactly what host it came from. It was

Re: [Clamav-users] SomeFool.P/Q occasionally passing through

2004-08-12 Thread Arthur Kerpician
Arthur Kerpician wrote: Todd Lyons wrote: Brian Morrison wanted us to know: >Received: from localhost [127.0.0.1] by backup.ccina.ro with >SpamAssassin (2.60 1.212-2003-09-23-exp); Wed, 11 Aug 2004 17:53:00 >+0300 This is the last line of Received headers, so it never says exactly wha

Re: [Clamav-users] [Solved] SomeFool.P/Q occasionally passing through

2004-08-16 Thread Arthur Kerpician
Todd Lyons wrote: Nigel Horne wanted us to know: On Friday 13 Aug 2004 8:08 pm, Todd Lyons wrote: I wonder. If you hit the max threads and are using the clamav-milter, then it will drop through. Try picking up the max threads in clamav.conf and see if that makes a difference. Not t

[Clamav-users] Multilog patch / daemontools

2004-10-03 Thread Arthur Kerpician
Hi all, I was using clamav-0.75.1 with daemontools and a stderr-patch (developed for 0.70 but working on 0.75.1) to catch all the output to multilog. I recently upgraded to clamav-0.80rc3 and I found that when starting the clamd service 2 instances of clamd are running and the log shows me that

Re: [Clamav-users] Multilog patch / daemontools

2004-10-04 Thread Arthur Kerpician
[EMAIL PROTECTED] wrote: Hi all, I was using clamav-0.75.1 with daemontools and a stderr-patch (developed for 0.70 but working on 0.75.1) to catch all the output to multilog. I recently upgraded to clamav-0.80rc3 and I found that when starting the clamd service 2 instances of clamd are running

[Clamav-users] ClamAV & daemontools

2004-10-29 Thread Arthur Kerpician
Hi all, How can I start clamav-0.80 under daemontools? The script I was using with 0.75 worked fine but since the upgrade to 0.80, it fires up 2 instances of clamav. The first process seems to be standalone (but started by svc) and the second one, running under daemontools gives the error about

Re: [Clamav-users] ClamAV & daemontools

2004-10-29 Thread Arthur Kerpician
Rick Macdougall wrote: Arthur Kerpician wrote: Hi all, And this is clamd.conf: LogFile /dev/stdout LocalSocket /tmp/clamd FixStaleSocket MaxThreads 20 User qscand ScanOLE2 ScanMail ScanHTML ScanArchive ScanRAR Foreground in clamd.conf Regards, Rick