Re: [Clamav-users] new stable?

2003-11-17 Thread Christopher X. Candreva
On Mon, 17 Nov 2003, Roger Koot wrote: > and would like to upgrade to 0.65. > but I'd like to know whether there are new issues and whether an upgrade > wouldn't wreck my current setup. I'm not useing mailscanner, but clamd itself has been much more stable for me under 0.65 (Solaris 8 on Sparc, c

Re: [Clamav-users] Autochecking script for clamd

2003-11-28 Thread Christopher X. Candreva
On Thu, 27 Nov 2003 [EMAIL PROTECTED] wrote: > daemontools isn't "special", whatever that means, and bash shells are 'sepcial' is in a default installation. As in there is nothing called daemontools on my Solaris 8 server. There is however both sh and bash. =

Re: [Clamav-users] Autochecking script for clamd

2003-11-28 Thread Christopher X. Candreva
On Fri, 28 Nov 2003 [EMAIL PROTECTED] wrote: > bash is not a part of the default solaris 8 server installation. neither is > clamav, for that matter. This is quickly getting off topic -- however a number of gnu type utils were included in Solarius 8, and I am fairly sure /bin/bash was one of them

[Clamav-users] Follow-up on clamav-milter not mailing notice to postmaster

2005-05-13 Thread Christopher X. Candreva
Even though it's been a few weeks, I wanted to follow up to my problem. When upgrading to 0.84 I ran into a problem where one of my machines would no longer send mail notifications to postmaster. This turned out to be my own fault. I built the binary on a machine that had a link for sendmail

[Clamav-users] Re: Follow-up on clamav-milter not mailing notice to postmaster

2005-05-14 Thread Christopher X. Candreva
May I add that it is really, really, really bad for clamav-milter to refuse to run at all, just because it can't write to it's log file ? I would much prefer it doing something and not logging then takeing down the whole mail system. == C

Re: [Clamav-users] Re: Follow-up on clamav-milter not mailing notice to postmaster

2005-05-16 Thread Christopher X. Candreva
On Sat, 14 May 2005, Dennis Peterson wrote: > Clam runs fine when properly configured. And it ran fine for me right up intil 0.85. > Are you asking the developers to > compensate for sloppy administration? I think for that you need a No, what I'm asking for is if it runs one day with certain p

Re[2]: [Clamav-users] 0.85 & 0.81.1 tha same troubles with milter

2005-05-17 Thread Christopher X. Candreva
On Tue, 17 May 2005, Sergey wrote: > i've just noticed the same thing. clamd.log is made by root. but 0.84 > doesn't care about that it works properly. Yes -- this is what I posted about Sat morning. Previous to 0.85, clamav-milter didn't care if it couldn't write to it's log file. Starting wi

Re[2]: [Clamav-users] 0.85 & 0.81.1 tha same troubles with milter

2005-05-17 Thread Christopher X. Candreva
On Tue, 17 May 2005, Sergey wrote: > >> -rw-r- 1 rootclamav 1265 May 17 15:40 clamd.log > AZ> ^^ > i've no idea, but 0.84 does. To be more helpfull -- 0.84 can't write to it either, it just ran anyway. Make sure whatever script you use the cycles log fil

Re: Re[2]: [Clamav-users] 0.85 & 0.81.1 tha same troubles with milter

2005-05-17 Thread Christopher X. Candreva
On Tue, 17 May 2005, Dennis Peterson wrote: > You will have solved the problem only if you put this procedure in your > startup scripts and any tools that rotate your logs. Gee, I wish I had already posted that -- oh wait, I did. == Chris

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Christopher X. Candreva
On Tue, 17 May 2005, Dennis Peterson wrote: > What do you think the PTR for a host with 500 virtual domains might look > like? It doesn't matter -- as long as it points to some name that points back to the same IP. mail723.theprovidersdomain.com would work. ===

Re: [Clamav-users] Problem in clamav startup on solaris

2005-05-18 Thread Christopher X. Candreva
On Tue, 17 May 2005, Eric J. Wisti wrote: > How are others with Solaris handling the socket? I put my socket in /var/clamav instead of /var/run [Libby]:/var$ ls -ld clamav/ drwxrwsr-x2 clamav clamav512 May 17 11:06 clamav/ Both the clamd and clamav-milter sockets are there, along

Re: [Clamav-users] Re: Clamav-milter dies after working ok for some hours

2005-05-24 Thread Christopher X. Candreva
On Tue, 24 May 2005, N Fung wrote: > I'm experiencing this too (clamav-milter 0.85.1 without > clamd) with log entries like these: Try with clamd and use the --external option to clamav-milter. == Chris Candreva -- [EMAIL PROTECTED] -- (9

[Clamav-users] clamd dies on reload with devel-20050524

2005-05-26 Thread Christopher X. Candreva
I've been trying out the 20050524 devel snapshot on one of my servers since the post regarding the buffer overrun problem. System is Solaris 8 on UltraSparc, gcc 3.4.0 The 20050524 clamd is now dieing on database reloads. (I just upgraded to the 20050526 snap, same behavior) Enableing debug w

Re: [Clamav-users] clamdscan vs clamscan - detection

2005-05-31 Thread Christopher X. Candreva
On Tue, 31 May 2005, Odhiambo Washington wrote: > I am just wondering why clamscan rightly detects the trojan in the mail > while clamdscan doesn't. Check the output of clamscan -V and clamdscan -V -- make sure they report the same database version number. ==

Re: [Clamav-users] Easiest setup for ClamAV and procmail

2005-06-02 Thread Christopher X. Candreva
On Thu, 2 Jun 2005, Kelly Corbin wrote: > What's the simplest setup to add ClamAV scanning to procmail? I'd like to add Here is a recipie I haevn't used in over a year, you'll at least have to remove the --mbox option and see what else is current, but this is the general idea. #Replace with

Re: [Clamav-users] Question about clamd commands

2005-06-07 Thread Christopher X. Candreva
On Tue, 7 Jun 2005, Ronny Nussbaum wrote: > In the documentation, it says that clamd accepts commands such as PING, > VERSION, etc. > Every time I start clamd, it just starts the daemon in the background. > If I do "clamd PING", I get a daemon namedclamd PING. You send these commands to th

Re: [Clamav-users] Question about clamd commands

2005-06-07 Thread Christopher X. Candreva
On Tue, 7 Jun 2005, Ronny Nussbaum wrote: > Thanks, but I was wondering if there's an easier way to communicate with the > already-running process. > I'm looking for something that I could do from a shell prompt rather than a > script. Change the program to send whatever command you give it on

[Clamav-users] Mytob.dj (or some variant) apparently not detected by Clam

2005-06-09 Thread Christopher X. Candreva
It appears the last round of mails sent by Mytob.dj (or a close variant) are not being detected in the current sigs (921). I'm going by the description here: http://securityresponse.symantec.com/avcenter/venc/data/[EMAIL PROTECTED] As of last night I only had bounces for samples, and submitted

RE: [Clamav-users] Clamav + Exim on FreeBSD

2005-07-07 Thread Christopher X. Candreva
On Thu, 7 Jul 2005, Daniel J McDonald wrote: > You desperately need a newer version. Many zip files will crash that > one. A new version was released yesterday that fixed another crash. www.zlib.net is still showing 1.2.2 from Oct 3 2004 as the latest version. Where is the version that was rel

RE: [Clamav-users] Clamav + Exim on FreeBSD

2005-07-07 Thread Christopher X. Candreva
On Thu, 7 Jul 2005, Trog wrote: > http://www.gzip.org/ Thanks, but http://www.gzip.org/zlib/ is also showing 1.2.2 from 10/3/2004 as the current version. (www.zlib.net is listed here as the US mirror for www.gzip.org/zlib/ ) -Chris ==

RE: [Clamav-users] Clamav + Exim on FreeBSD

2005-07-07 Thread Christopher X. Candreva
On Thu, 7 Jul 2005, Trog wrote: > What I wrote and what you wrote are different, hence different results. You are correct. You wrote: > http://www.gzip.org/ However, The last modified date of the www.gzip.org page is July 27, 2003. There is no mention of a new version 'yesterday' (July 6 2005)

RE: [Clamav-users] Clamav + Exim on FreeBSD

2005-07-07 Thread Christopher X. Candreva
On Thu, 7 Jul 2005, jef moskot wrote: > On Thu, 7 Jul 2005, Christopher X. Candreva wrote: > > www.zlib.net is still showing 1.2.2 from Oct 3 2004 as the latest version. > > Where is the version that was released yesterday ? > > It affects FreeBSD 5.4 and 5.4, so if you ha

Re: [Clamav-users] managed ClamAV relays?

2005-08-22 Thread Christopher X. Candreva
On Sun, 21 Aug 2005, Roger Rustad wrote: > I'm worried about all of these Exchange users, though. How do I make sure > that they can connect anywhere (cafe, cable modem, etc) and still make sure > that spammers don't send crap to exchange.domain.com? The same way everyone else does, use the auth

Re: [Clamav-users] Spyware detection...

2005-09-12 Thread Christopher X. Candreva
On Mon, 12 Sep 2005, Stephen J. Smoogen wrote: > I am currently looking at doing the same thing. I have a set of boxes > that I am planning to 'infect' with spyware and then start making > signatures for them. It is a rather slow process at the moment.. There doesn't seem to be any reason a separ

Re: [Clamav-users] Tagging fraud type messages

2005-09-13 Thread Christopher X. Candreva
On Tue, 13 Sep 2005, Chris said: > Can ClamAV be configured (I guess thats the right word) to tag fraud type > messages the same as it does with phishing messages? For instance this: Spam Assassin does a very good job of picking these up. I find the combination of ClamAV and Spam Assassin very e

Re: [Clamav-users] Tagging fraud type messages

2005-09-13 Thread Christopher X. Candreva
On Tue, 13 Sep 2005, Chris wrote: > That it does. I just didn't know if this was something that ClamAV could > also > tag as it does phishing or not. To almost contradict my earlier answer -- Clam DOES find phish mails, they have been adding signatures for a wihle. However, what it does fi

RE: [Clamav-users] Issues with ClamAV and RedHat Enterprise 2

2005-09-28 Thread Christopher X. Candreva
On Wed, 28 Sep 2005, Damian Menscher wrote: > > No it does not. Retract that statement immediately. > > Oh, sorry. That's what it says in my (patched) version. The released > version may say something different. Personally I like your version better. If the option can't be removed, you should

Re: [Clamav-users] Getting rid of an old install

2005-10-27 Thread Christopher X. Candreva
On Thu, 27 Oct 2005, Dennis Peterson wrote: > JamesDR said: > system runbook (everyone has runbooks, right?). It is very important that > upgrades be done on a clean system and that the running processes be > stopped before beginning the upgrade. My practice is to keep the freshclam > and clamd c

Re: [Clamav-users] Getting rid of an old install

2005-10-27 Thread Christopher X. Candreva
On Thu, 27 Oct 2005, Dennis Peterson wrote: > I consider all obsolete libraries to be debris and get rid of them. They > have no value and I don't need to waste tape space backing them up. Unless you have binaries built against the older versions that will suddenly start to fail when you delete

Re: [Clamav-users] Getting rid of an old install

2005-10-28 Thread Christopher X. Candreva
On Thu, 27 Oct 2005, Dennis Peterson wrote: > Great. You're happy, I'm happy. And along the way the question from the OP > as to how to remove an old install got answered. And the dev team can > remove all that krufty "make uninstall" support code as it's just not > needed. And those man pages for

Re: [Clamav-users] RE: Report infected mail to the user

2006-01-06 Thread Christopher X. Candreva
On Fri, 6 Jan 2006, Dennis Peterson wrote: > If you cannot reject it before the final .crlfcrlf then you keep it. It's > dead. Pinin' for the fjords, bleeding demised, an ex-message, shuffled off > it's mortal coil, lovely plumage and all. I will submit one other possibility: I use --postmaster-o

RE: [Clamav-users] RE: Report infected mail to the user

2006-01-06 Thread Christopher X. Candreva
On Fri, 6 Jan 2006, Brian McDonald wrote: > Chris this sounds like an excellent solution can you share how you did this? Calling it a hack is an insult to hacks. :-) I'll try to take some time and make a version I can put out (remove our IP addresses, SQL passwords, etc)

Re: [Clamav-users] virus not detected

2006-01-18 Thread Christopher X. Candreva
On Wed, 18 Jan 2006, Payal Rathod wrote: > Me and many friends here are troubled by a new virus which has > attachments like Video_part.mim, Attachment.hqx etc. We are getting this > since last 36 hours and a friend submitted a few samples to clamav Make sure your virus sigs are up to date. If

Re: [Clamav-users] virus not detected

2006-01-18 Thread Christopher X. Candreva
On Wed, 18 Jan 2006, Payal Rathod wrote: > daily.cvd is up to date (version: 1244, sigs: 840, f-level: 6, builder: > sven) FYI, I have three instances of WORM.VB-8 in my logs from yesterday, so even 1244 detects a non-zero number of these. Evidently just not the one you have ==

Re: [Clamav-users] [EMAIL PROTECTED] undetected

2006-01-19 Thread Christopher X. Candreva
On Thu, 19 Jan 2006, Gerard Seibert wrote: > Thomas Hochstein <[EMAIL PROTECTED]> > > "Worm.VB-8" is ClamAV's name for [EMAIL PROTECTED], according to the > > advisories I read. > I believe that, that definition was only added on the 18th. On 2/16 and Not true. The first VB-8 I have logged is f

Re: [Clamav-users] [EMAIL PROTECTED] undetected

2006-01-19 Thread Christopher X. Candreva
On Thu, 19 Jan 2006, Bill Maidment wrote: > > Not true. The first VB-8 I have logged is from 11:53 EST on Jan 17 . > That all depends on your time zone. EST in Australia may be different to EST > somewhere else. Let's not get into a fight over this. I mean GMT-0500 . I wasn't aware there were a

Re: [Clamav-users] Web Site Authentication Prior to VirusDB download

2006-02-02 Thread Christopher X. Candreva
On Thu, 2 Feb 2006, [EMAIL PROTECTED] wrote: > The company I work for has implemented a firewall that only allows certain > activity through it. I have requested that the user agent string > "clamav/*" be allowed to communicate with the internet. The request has > been refused because of secu

Re: [Clamav-users] Zafi worm misidentified as Trojan.Downloader.Small-1004

2006-02-03 Thread Christopher X. Candreva
On Fri, 3 Feb 2006, Diego d'Ambra wrote: > I'm investigating this. > > I believe that signature small-1004 is matching some sort of PE > packer/obfuscater and must be updated to avoid detecting unrelated malware. Personally, I'm not as interested in naming the viruses as much as blocking them.

[Clamav-users] .ppt files take a long time to scan

2006-03-16 Thread Christopher X. Candreva
I'm running into issues where (so far as I can tell) .ppt files can take a long time to scan. As an exmaple, I have a 2.8 meg 5 slide .ppt file that takes 90 seconds to scan on an otherwise-quiet 1.5ghz Athlon. For camparison, a random 3 meg .pdf file scanned in under a second. Is this normal

Re: [Clamav-users] .ppt files take a long time to scan

2006-03-19 Thread Christopher X. Candreva
On Sat, 18 Mar 2006, des wrote: > "Your disk is slow" or "don't scan large files" is a common response. Well, I'm using ramdisk for temp so I don't think that's it. > If you can provide a sample file to Trog to help find out what the > real issue is that would be great. Sent, hopefuly it helps.

Re: [Clamav-users] have I been banned?

2006-04-22 Thread Christopher X. Candreva
On Sat, 22 Apr 2006, John Hinton wrote: > > ERROR: Problem with internal logger. > I love answering my own post... I found the problem. Freshclam must have > bombed due to the dying server. It left a truncated log at the end of the log > file. I forced a rotate of the freshclam and clamav logs an

Re: [Clamav-users] OT: Download script

2006-04-24 Thread Christopher X. Candreva
On Mon, 24 Apr 2006, Steve Basford wrote: > Could anyone come up with some good wget/curl scripts, with wget, I guess it's > using the -N option to only download changes and only download hourly (eg. > 15:00, 16:00, 17:15, 18:15) etc. I use the following bit of perl. If you have access to your o

Re: [Clamav-users] OT: Download script

2006-04-24 Thread Christopher X. Candreva
On Mon, 24 Apr 2006, Steve Basford wrote: > a) phish.ndb.gz Definately. == Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/ _

Re: [Clamav-users] OT: Download script

2006-04-24 Thread Christopher X. Candreva
On Mon, 24 Apr 2006, Steve Basford wrote: > The file you need is: http://www.sanesecurity.com/clamav/phish.ndb.gz I've atached my updated Perl script. It will now check the compressed archive, and if it is updated download and upcompress it.

Re: [Clamav-users] OT: Download script

2006-04-25 Thread Christopher X. Candreva
On Tue, 25 Apr 2006, Bob Hutchinson wrote: > On Monday 24 Apr 2006 22:35, Steve Basford wrote: > using the --stdout method results in a new timestamp. For me that is > confounding. Yes. Unfortunately I didn't see any other way to keep the original .gz file intact. The LWP mirror library needs

Re: [Clamav-users] OT: Download script

2006-04-25 Thread Christopher X. Candreva
On Tue, 25 Apr 2006, Bob Hutchinson wrote: > The trouble with perl system() calls is that you don't get any result > codes, I might experiment with backticks instead. Someone suggested touch, here's the simple way: if ($result == 200) { system "gunzip -v --stdout $file > $dbfile"; my ($dev,

Re: [Clamav-users] Re: OT: Download script

2006-04-25 Thread Christopher X. Candreva
On Tue, 25 Apr 2006, G.W. Haywood wrote: > > If you know a gunzip option that will NOT delete the compresed file, > > that would be the prefered method. > > cat file.gz | gunzip > file That's not a gunzip option -- that's (almost) exactly what I'm doing in the program that I'm looking for an al

Re: [Clamav-users] Re: OT: Download script

2006-04-25 Thread Christopher X. Candreva
On Tue, 25 Apr 2006, Rick Macdougall wrote: > > That's not a gunzip option -- that's (almost) exactly what I'm doing in the > > program that I'm looking for an alternative for. > > gunzip -c file.gz > file Yes, THAT is EXACTLY what I'm doing that we are (were) looking for an alternative for. :-

Re: [Clamav-users] OT: Download script

2006-04-25 Thread Christopher X. Candreva
On Tue, 25 Apr 2006, Chris wrote: > phish.ndb.gz500 > > as a guess does this mean there was no new file to download? A 500 status code is an internal server error. Nothing to do with the script. == Chris Candreva -- [EMAIL PROTECTED]

Re: [Clamav-users] OT: Download script

2006-04-26 Thread Christopher X. Candreva
On Wed, 26 Apr 2006, Chris wrote: > "A 500 status code is an internal server error. Nothing to do with the > script." "99% of all problems under Unix are permissions" Aside from it being under cron, what else is different. UserID, evnironment, shell, PWD, etc ? ==

RE: [Clamav-users] Error while loading shared libraries

2006-05-02 Thread Christopher X. Candreva
On Tue, 2 May 2006, [EMAIL PROTECTED] wrote: > Robert Isaac wrote: > > The libclamav.so.1 files are 777 > > Danger, Will Robinson! Probably not. It's a symbolic link. Those are always mode 777 . Actually what lrwxrwxrwx comes out as numericly ===

Now OT - Re: Out of Office AutoReply: [Clamav-users] Question About Quarantine

2006-05-17 Thread Christopher X. Candreva
On Wed, 17 May 2006, Daniel T. Staal wrote: > These days, being out of the office, or town, or country, is no reason for > you to not be able to get your email, if you felt you needed to. So, the > only reason you aren't responding is that you don't want to. I would say the problem is people exp

Re: Now OT - Re: Out of Office AutoReply: [Clamav-users] Question About Quarantine

2006-05-17 Thread Christopher X. Candreva
On Wed, 17 May 2006, Bart Silverstrim wrote: > That's where you're both wrong. It's an extension to instant messaging. Why Really ? That's amazing, that email managed to be invented at least a decade before IM and still extended it. > It's an EXCHANGE based world, people! C'mon and catch up

Re: [Clamav-users] Unsuscribe

2006-05-17 Thread Christopher X. Candreva
On Wed, 17 May 2006, Luis Vargas wrote: > how do I unsuscribe from this list? I got another account registered in this Read the URL on the bottom of every message. > http://lurker.clamav.net/list/clamav-users.html == Chris Candreva --

Re: [Clamav-users] $ sudo freshclam ERROR: Problem with internal logger.

2006-06-04 Thread Christopher X. Candreva
On Sun, 4 Jun 2006, Obantec Support wrote: > I have just started seeing this error and have been running clamav for 6 or > more months. > i did upgrade to 88.2 recently and i now see > > ERROR: Problem with internal logger. Means another copy of freshclam was already running. =

RE: [Clamav-users] clamd cannot allocate memory. Resolutions?

2006-08-02 Thread Christopher X. Candreva
On Wed, 2 Aug 2006, Nigel Horne wrote: > 0.88.3 is a bug fix of 0.88.2, 0.88.2 is a bug fix of > 0.88.1, 0.88.1 is a bug fix of 0.88. 0.88, as I said is very > old. True some bug fixes are major, but my point stands whether you > wish to argue about it or not - I should know I wrote the stuff > th

[Clamav-users] Recomended nightly snap, or beta version ?

2006-08-30 Thread Christopher X. Candreva
Since the repeated advice has been to run CVS, I'm going to repeat the question - is there a recomended snapshot date that is more likely to run than others ? Would it be possible to pick a good date and publish a beta ? Something that may have problems, but at least is known to compile and ru

Re: [Clamav-users] Can I give clam a list of files to scan

2006-09-08 Thread Christopher X. Candreva
On Fri, 8 Sep 2006, Dennis Peterson wrote: > Seems not to work in Solaris. As a Solaris fan -- you REALLY want to install gnu find, and grep, and fileutils. At least. Sun still for whatever reason doesn't support many newer options, newer being post 1989.

Re: [Clamav-users] ERROR: Problem with internal logger.

2006-09-14 Thread Christopher X. Candreva
On Thu, 14 Sep 2006, Aleksey Luzin wrote: > > # freshclam > ERROR: Problem with internal logger. > > What does it mean? and how I can fix it? It means there is another instance of freshclam running. If it's still running, kill it. == Chr

[Clamav-users] 0.90rc1 missing thing 0.88.5 catches

2006-10-21 Thread Christopher X. Candreva
I have a sample of W97M.Lafool.U caught by 0.88.5 that 0.90rc1.1 says is clean. I also received an almost identical mail that both say is clean. The second I've submitted as a new virus sample. The first isn't taken, since the web form's 0.88.5 catches it. I assumed I had missed a config opt

Re: [Clamav-users] 0.90rc1 missing thing 0.88.5 catches

2006-10-21 Thread Christopher X. Candreva
On Sat, 21 Oct 2006, Christopher X. Candreva wrote: > I have a sample of W97M.Lafool.U caught by 0.88.5 that 0.90rc1.1 says is > clean. I also received an almost identical mail that both say is clean. Looks like this may be a word/unpacker problem on Solaris/Sparc, as it is properly de

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Christopher X. Candreva
On Mon, Oct 23, 2006 at 05:53:30AM -0400, Gerard Seibert wrote: > Anyway, we send out several times a week flyers to our customers. These > mailings range from 750 to 2000 messages per run. To scan 2000 identical > messages is insane, not to mention a total waste of system resources. > Other tha

[Clamav-users] Compiling rc2 on Solaris

2006-10-31 Thread Christopher X. Candreva
I don't know if this helps anyone else, but on Solaris 8 I had to tell configure explicily to use bash instead of stock sun /bin/sh . It was generating an error on the check for the clamav user (looked like it was trying to run a program called clamav:: ) ==

Re: [Clamav-users] Compiling rc2 on Solaris

2006-11-07 Thread Christopher X. Candreva
On Tue, 7 Nov 2006, Tomasz Kojm wrote: > Please report the problem to http://bugs.clamav.net Opened. Sorry, I just assumed it was Sun's problem. == Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet Internet Services of Westche

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-07 Thread Christopher X. Candreva
On Tue, 7 Nov 2006, Jim Redman wrote: > Your opinions, seem to be the prevalent attitude of the vocal members of this > list - if you don't suffer, it wasn't worth it. I would disagree, in that I don't see it as suffering. Forgive me if I missed it, but what is your specific problem ? Perhaps we

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-09 Thread Christopher X. Candreva
On Thu, 9 Nov 2006, Daniel J McDonald wrote: > > > My observation is that of all the modern packages ClamAV fails to > > > install and run successfully and securely without operator > > > intervention. I think that this should be refined to reference > > > Fedora packages and perhaps not al

Re: [Clamav-users] clamav 0.92rc2 not updated with new virus db?

2006-11-10 Thread Christopher X. Candreva
On Fri, 10 Nov 2006, zamri wrote: > I use clamav 0.90rc2 and my friend uses clamav 0.88.5 (the latest > stable). Just now, after I ran freshclam, i run clamdscan for a worm. > His could detect it as worm and mine didn't. Why is that? It would be helpful to state what platform and what worm. IE,

Re: [Clamav-users] clamav 0.92rc2 not updated with new virus db?

2006-11-10 Thread Christopher X. Candreva
On Fri, 10 Nov 2006, Ken Jones wrote: > > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=89 > Access Denied > You are not authorized to access bug #89. I think the clam Bugzilla require you to have an account and be logged in to watch bugs. =

Re: [Clamav-users] clamav 0.92rc2 not updated with new virus db?

2006-11-10 Thread Christopher X. Candreva
On Fri, 10 Nov 2006, Ken Jones wrote: > I do have an account I even have open reported bugs that I am working on > with the developers :) (ok, I've reported and they are trying to fix) Look man, I just use the bugzulla. I don't want to have to understand how it works. < Ducks for cover . .

Re: [Clamav-users] clamav 0.92rc2 not updated with new virus db?

2006-11-10 Thread Christopher X. Candreva
On Fri, 10 Nov 2006, Dennis Peterson wrote: > He scores! "Thank you, I'll be here all week. Don't forget to tip your waitresses." > I get the same login error, btw, and since I use Solaris exclusively, I'm > interested. Look like it's been clasified as a security bug, so I'll let the devel

Re: [Clamav-users] clamav 0.92rc2 not updated with new virus db?

2006-11-13 Thread Christopher X. Candreva
On Tue, 14 Nov 2006, zamri wrote: > I assume the answer is yes. :) No, it probably means you didn't provide any of the information that was asked for -- what it found, your platform and OS, etc. Your premise that rc.2 isn't "updated" is wrong. There may be a language barrier causing this, but

Re: [Clamav-users] Compiling Clamav-0.9RC2 on Solaris Intel

2006-11-27 Thread Christopher X. Candreva
On Mon, 27 Nov 2006, Jonathan Armitage wrote: > I have just tried to configure, make and install Clamav-0.9RC2 on a Dell PC > running Solaris 10. I have previously done the same with various 0.8 versions I don't know if this is your issue, but if you have bash installed, try editing the first li

Re: [Clamav-users] Re: Newbie-inquiry

2006-12-19 Thread Christopher X. Candreva
On Tue, 19 Dec 2006, G.W. Haywood wrote: > Has anyone else observed such large improvements? Yes. 0.8.x boggs down on some MIME types. The 0.9x RC's have been much faster. == Chris Candreva -- [EMAIL PROTECTED] -- (914) 967-7816 WestNet I

[Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
Is there a compelling reason for clam to die on a malformed database, instead of just ignoring the bad line and continuing with all the other sigs ? == Chris Candreva -- [EMAIL PROTECTED] -- (914) 948-3162 WestNet Internet Services of We

Re: [Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
On Sat, 30 Dec 2006, Sander Holthaus wrote: > A malformed database points to: > > - - serious system malfunction > - - security breach > - - security breach / system malfunction between you and (or at) the > database provider In my experience, it means a database maintainer who made a simple m

Re: [Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
On Sat, 30 Dec 2006, Bill Landry wrote: > The MSRBL-Images.hdb database started showing up corrupted yesterday and This is not the only reason I ask, but the most recent. I have a script that checks that evidenly has a bug. I can either spend time fixing that, or fixing clam so it ignores the

Re: [Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
On Sat, 30 Dec 2006, Tomasz Kojm wrote: > Freshclam provides this and much more. Except the ability to operate from a given specific URL pointing to a file. If the only updates come from freshclam-verified sources it wouldn't be so bad. The problem comes up that other mechanisims are necessry f

Re: [Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
On Sat, 30 Dec 2006, Dennis Peterson wrote: > There's no limitation for choosing a URL - you can put anything you like in > the freshclam.conf file. Using the --config-file=FILE option of freshclam in The only option I see in man freshclam.conf is for a database mirror server name, not a URL.

Re: [Clamav-users] Why does clam die on a malformed database ?

2006-12-30 Thread Christopher X. Candreva
On Sun, 31 Dec 2006, Luca Gibelli wrote: > > How exactly is this better then a possibe false-positive, if a corrupted > > sig > > happens to match some valid piece of mail ? > > It's better to delay N emails rather than delete N emails. A false-positive won't delete the mail - it will cause an

Re: [Clamav-users] Should I submit...

2007-01-17 Thread Christopher X. Candreva
On Wed, 17 Jan 2007, Sander Holthaus wrote: > a very basic perl script which opens a listening socket and a shell? I > found it after a hacker tried to gain entry. The script is nothing > special (far from, 612 bytes) but I doubt people are actually using it > for any legitimate means. BitDefender

Re: [Clamav-users] Phishing, my webserver hacked

2007-01-23 Thread Christopher X. Candreva
On Tue, 23 Jan 2007, Todd Lyons wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hey, who's the guy who maintains the phishing sigs? They hacked my http://www.sanesecurity.com/clamav/ == Chris Candreva -- [EMAIL PROTECTED] -

Re: [Clamav-users] scan performance

2007-01-25 Thread Christopher X. Candreva
On Thu, 25 Jan 2007, Helmut Schneider wrote: > I don't want to discuss about performance in general, I would just like to > know if this is "normal" and/or if there is a way to tune up that process. > > I use 0.88.7 Yes, it is normal for 0.88.x The 0.90rc2 release has greatly improved performan

Re: [Clamav-users] Re: scan performance

2007-01-26 Thread Christopher X. Candreva
On Fri, 26 Jan 2007, Helmut Schneider wrote: > > The 0.90rc2 release has greatly improved performance. > > OK. Could you define "greatly improved"? I'm quite happy with clamav but I use > postfix/amavis with pre-queueing and therefore... :) It's been a while, but things that took minutes to scan

Re: [Clamav-users] Release-Date for 0.90 ??

2007-02-01 Thread Christopher X. Candreva
On Thu, 1 Feb 2007, Arnaud Jacques wrote: > Yeah, we all waiting for this new stable release :) I've been running 0.90rc2 here for a few months. IMHO it is more stable than the 0.88.x I was running previously. Just yeaterday I received a Bugzilla note from one I had submitted that it was fixed

Re: [Clamav-users] Release-Date for 0.90 ??

2007-02-01 Thread Christopher X. Candreva
On Thu, 1 Feb 2007, Dennis Peterson wrote: > 50-50 isn't bad. Can you share your configure params? Compiled fine on Solaris 8 Sparc, gcc 4.1.1, binutils 2.17 I configure with just ./configure --enable-milter == Chris Candreva -- [EMAIL PR

Re: [Clamav-users] 0.90rc3 on Sparc Solaris 9

2007-02-02 Thread Christopher X. Candreva
On Fri, 2 Feb 2007, Stephen Gran wrote: > What breaks? I agree that at first glance it seems like an unnecessary > include, but I'm curious what error you get. Here are the errors I get building rc3 with --enable-experimental gcc 4.1.1 binutils 2.17 gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I./u

Re: [Clamav-users] Upgrade to .90?

2007-02-15 Thread Christopher X. Candreva
On Thu, 15 Feb 2007, Dennis Peterson wrote: > In my case the only difference from every previous build was to enable > experimental. I have just one build script I've used for years. Try without experimental. I have a similar set-up (Sun Sparc Ultra 2s, Solaris 8, gcc 4.1.1) I was running 0.90

Re: [Clamav-users] Upgrade to .90?

2007-02-15 Thread Christopher X. Candreva
On Fri, 16 Feb 2007, Steve Holdoway wrote: > Have you patched 8.14.0. I had everything falling over until I did that... FWIW the problems I had were with 8.13.8 == Chris Candreva -- [EMAIL PROTECTED] -- (914) 948-3162 WestNet Internet Ser

Re: [Clamav-users] Re: first impressions on 0.90

2007-02-16 Thread Christopher X. Candreva
On Fri, 16 Feb 2007, Stephen Gran wrote: > What would be the point of having a socket ready before clamd is ready > to do any work? Maybe I'm missing something. It would be something for other programs to connect to and wait for a response, instead of generating a "socket does not exist" error.

Re: [Clamav-users] Re: first impressions on 0.90

2007-02-16 Thread Christopher X. Candreva
On Fri, 16 Feb 2007, Stephen Gran wrote: > > It would be something for other programs to connect to and wait for a > > response, instead of generating a "socket does not exist" error. > > So that they could potentially wait around until their internal timeout, > instead of immediately returning?

Re: [Clamav-users] msrbl sigs: rsync

2007-03-05 Thread Christopher X. Candreva
On Mon, 5 Mar 2007, Dennis Peterson wrote: > > It makes a great deal of sense to move the files into the clam DB directory > > to insure an atomic operation. If clamd/clamav-milter should happen to > > reload with a half-copied file in the DB dir, it will likely stop running. > > Yah - I realize

Re: [Clamav-users] Local socket unsafe

2007-03-07 Thread Christopher X. Candreva
On Thu, 8 Mar 2007, CPTeam Hostmaster wrote: > I get this in maillog whenever I start clamav-milter: > > -- > Mar 8 00:45:01 ns1 sendmail[7399]: l27Mj1nM007399: Milter (clmilter): local > socket name /var/run/clamav/clmilter.sock unsafe > Mar 8 00:45:01 ns1 sendmail[7399]: l27Mj1nM007399: Milte

<    1   2   3