ClamAV polling system with select ClamAV users around the world
so we could see a visual map of how these things spread and where
the damage or infection is greatest.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK
r per hour in a
particular geographic region or (ideally) state/country.
Of course, I wrote the above thinking of a client/server solution, but a sort of
ad-hoc computer-computer network might work too. That would certainly change the trust
system a good bit. Hmmm... something to think about.
I&#
rchive
and ScanMail (because I want the binhex feature on).
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Ne
that recently.
>
> -Nigel
No, it's strictly text and just a LOT of characters. I can send it zipped
or a small sample if anyone is interested. It has a lot of repeating
characters, so it aught to compress rather well.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services
Tomasz Kojm wrote:
> On Mon, 22 Mar 2004 15:54:18 -0500
> Jesse Guardiani <[EMAIL PROTECTED]> wrote:
>
>> Any ideas on how to avoid this in the future? I'm running with
>> ScanArchive and ScanMail (because I want the binhex feature on).
>
> The problem m
amd. That's what I would do. :)
> It's a release candidate, not a recognized stable
> code. Just a thought.
I'm aware of that. Besides this stress testing bug I haven't
had any problems with it. The upgrade was well worth the risk
for the new features.
--
Jesse Guardiani,
r scanners and it would make it real
> easy to find.
I'd like to add a quick: Me too
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (
virtually every machine known to man. That's my experience with C anyway.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
Tomasz Kojm wrote:
> On Mon, 22 Mar 2004 15:54:18 -0500
> Jesse Guardiani <[EMAIL PROTECTED]> wrote:
>
>> Any ideas on how to avoid this in the future? I'm running with
>> ScanArchive and ScanMail (because I want the binhex feature on).
>
> The problem m
D seems to be OLE2.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is sponsored by:
an.
What is your MaxThreads value set to in clamav.conf?
How about MaxConnectionQueueLength?
It's possible that ClamAV already has MaxThreads number of threads running
and your 4k message is sitting in the connection queue waiting for a thread
to become available so it can run.
--
Jesse Guardiani,
h FreeBSD's process vs. threading memory limits though.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email
also.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tut
you see above.
Is your clamd process even running? Or did it die? I don't see it
listed above.
Also, what's your `uname -a`?
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.
Nigel Horne wrote:
> On Thursday 25 Mar 2004 10:05 pm, Jesse Guardiani wrote:
>
>> Is there any way to make clamd log the structure of
>> a message and it's attachments? BinHex, MIME, plain-text,
>> ZIP, RAR, BZIP, GZIP, OLE2, etc...?
>
> I don't consid
had 'com' extension!!
>
> Better i block the 'com' extension itself,atleast reducing the load on
> CLAM :))
Which scanner are you using? qmail-scanner scans viruses FIRST, then blocks
extensions based on policy. This change was made between 1.20-rc2 and 1.20-rc3
if I reme
pwd-1
1 Worm.Bagle.Gen-1
1 W32.Magistr.B5
1 W32.Magistr.B
1 Trojan.URLspoof.gen.2
1 SCR - (ATTACHMENT)
1 PIF - (ATTACHMENT)
1 LNK - (ATTACHMENT)
1 Exploit.HTML.Bagle.Gen-7-eml
1 Exploit.HTML.Bagle.Gen-3-eml
1 Disallowed breakage found in header name - potential virus
--
Jes
Jesse Guardiani wrote:
[...]
> I see similar symptoms when my clamd (0.70-rc) process chokes on a
> message it doesn't like. The clamd process starts eating between 50%
> and 100% CPU and gobbling up RAM.
Quick note: The CVS version from 2004/03/26 fixes this problem for
Mike Cathey wrote:
> Jesse,
>
> On Fri, 2004-03-26 at 10:46, Jesse Guardiani wrote:
>> :) Why not if it can already performing actions on the above
>> items?
>
> Clamav is a virus scanner. Features like that belong in whatever rips
> apart messages for Clamav t
ys: "grep: unknown directories method"?
I don't know. Please read `man grep` to find out.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
th the GPL.
I still don't understand what the big deal is with calling external
unpacking programs. Security risk? How? qmail-scanner does it. And
you don't have to enable it by default. And all of these silly rar
memory leak and licensing issues would evaporate.
--
Jesse Guardiani, Systems
anOnExec
ClamukoIncludePath /home
ClamukoMaxFileSize 1M
ClamukoScanArchive
I there any chance this bug has been fixed in the
latest CVS?
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
42
Jesse Guardiani wrote:
[...]
> I there any chance this bug has been fixed in the
> latest CVS?
There must be some special email out there that triggers
this behavior. I've had to kill -9 the clamd process 3
times since my first message about this problem to this
list. If it happens
Odhiambo Washington wrote:
> * Jesse Guardiani <[EMAIL PROTECTED]> [20040402 20:12]: wrote:
>> Howdy list,
>>
>> We've been running CVS version devel-20040325
>> for about a week with great success, but just
>> this morning it locked up. I tried:
>
Todd Lyons wrote:
> On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote:
>
>> > I there any chance this bug has been fixed in the
>> > latest CVS?
>> There must be some special email out there that triggers
>> this behavior. I've had to kill -9 the clamd
Robert Blayzor wrote:
> On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote:
>
>> Howdy list,
>>
>>
>> # uname -a
>> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-RELEASE #0: Fri Apr
>> 11
>> 12:59:08 EDT
Todd Lyons wrote:
> On Fri, 2004-04-02 at 08:30, Jesse Guardiani wrote:
>
>> > I there any chance this bug has been fixed in the
>> > latest CVS?
>> There must be some special email out there that triggers
>> this behavior. I've had to kill -9 the clamd
Jesse Guardiani wrote:
> Robert Blayzor wrote:
>
>> On 4/2/04 10:53 AM, "Jesse Guardiani" <[EMAIL PROTECTED]> wrote:
>>
>>> Howdy list,
>>>
>>>
>>> # uname -a
>>> FreeBSD chortos.wingnet.net 4.8-RELEASE FreeBSD 4.8-
Todd Lyons wrote:
> On Fri, 2004-04-02 at 14:09, Jesse Guardiani wrote:
>
>> Mar 31 didn't work for me. See other email on the subject.
>
> You can download the tarball that I used for mine at
> http://downloads.mrball.net/SpamAssassin/clamav-0.70pre2.tar.gz
>
>
Jesse Guardiani wrote:
[...]
> I'll look into the locking thing. I'm also configuring a debug
> version so I can run ktrace on it. More in a bit. I can't go home
> until this silly thing is fixed...
Hmmm... I'm leaning toward a locking problem with the log file
at
Jesse Guardiani wrote:
[...]
> I'm going to try uncommenting LogFileUnlock in clamav.conf.
That didn't work. Help! I'm at a loss...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423
Jesse Guardiani wrote:
> Jesse Guardiani wrote:
>
> [...]
>
>> I'm going to try uncommenting LogFileUnlock in clamav.conf.
>
>
> That didn't work. Help! I'm at a loss...
Hmmm... Reverting to 0.70-rc seems to solve the problem
--
Jesse Guardia
hat does that do?
>
> It's in CVS, an option for clamd. From the combo you run, am I right in
> assuming you don't use clamd at all, but only clamdscan??? In that case
> then you don't run clamd as a daemon and FixStaleSocket really becomes
> irrelevant in your case.
As
Antony Stone wrote:
[...]
> I think the best we'll ever achieve is a cross-reference database.
Yes please.
What needs to be done to get this online? Who needs access to what?
Public reference submissions, or core maintainers?
I think we desperately need this functionality.
-
Jesse Guardiani wrote:
> Antony Stone wrote:
>
> [...]
>
>> I think the best we'll ever achieve is a cross-reference database.
>
> Yes please.
>
> What needs to be done to get this online? Who needs access to what?
> Public reference submissions
st like we submit virus samples now, then what harm would it
do to allow the door to swing both ways? And the benefit is obvious: Some windows
guy got infected with NetSky? Hmmm... I wonder what Clam calls that? Let's find
out...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Serv
uot;Virus name contains above"
selected, then click on "Netsky.AB Vendor: Fsecure" and the resulting
page doesn't even mention Worm.Somefool.AB.
I'm impressed by the information that *is* there though. If you can tweak
it until it spits out more relevant information then
han welcome.
Looks nice. I'm a little confused about the "top 10 viruses last month"
and "... last week" text though. What about this month and this week?
You got some source code I can download for that? :)
--
Jesse Guardiani, Systems Administrator
WingNET Internet Servi
#x27;s making long multi-meg mail
transfers near impossible. The up side is that
my mail is virus free. :) But I'd really love
to see a solution to this problem.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cl
reeBSD 4.8-RELEASE + daemontools. I don't see the seg
fault, but my clamd is hanging every 5 or 10 minutes and I'm forced to use monit
to test the socket and restart it if it's not working. This bug is really crimping my
style. :)
--
Jess
Jason Haar wrote:
> On Wed, May 05, 2004 at 02:15:29PM -0400, Jesse Guardiani wrote:
>> past 0.70-rc a month or two ago. 0.70 (upgraded just yesterday) does the
>> same thing. I'm running FreeBSD 4.8-RELEASE + daemontools. I don't see
>> the seg fault, but my
. Perhaps you
should take a look at monit.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This SF.Net email is spo
K. Shantanu wrote:
> On Mon, May 17, 2004 at 08:45:26AM -0400, Jesse Guardiani wrote:
>
>> It does if you delete the socket file from your run script. But you need
>> to upgrade to 0.70 anyway, and I imagine that you'll start having
>> problems with clamd hanging
seem to be the only person consistently experiencing this
problem.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
My experience
with Bacula on FreeBSD leads me to suspect a pthreads (libc_r) bug, but it
may very well just be a ClamAV bug. I'm personally doing everything I can
to track this down, but it's slow going.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 //
> It's fixed in CVS. Please update.
In my opinion a bug that major should warrant a new release, if only 0.74a
or 0.74.1. Asking people to update to CVS to fix a serious bug doesn't make
sense.
That would be like the linux kernel developers asking everyone to update to
CVS to fix c
because I've seen reports of viruses slipping
through 0.74 and 0.75.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
-
ake it into 75.1?
Or do I need to patch manually when I upgrade from
73 -> 75.1 on Monday?
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
-
p cpt->strarg
>> $7 = 0x805a0c0 "80.168.70.183"
>>
>> Since the call to gethostbyname has a valid argument, I'm guessing
>> there's probably some memory corruption causing this crash.
>
> Thank you for reporting this bug. gethostbyname() is no
D
users that has this problem though.
Tomasz Kojm has correctly asked me to get more information, but I haven't
been able to yet. I'm going to see if a CVS snapshot or 0.75.1 clears up
the problem on Monday.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 26
that in mind, is there a document, or a group of documents
out there that I can read (gimme RFCs, non-official standards, ANYTHING)
that describe the plethora of standards ClamAV uses or plans to use
in the future? Or maybe just a general list of what's currently out
there?
Thank
x27;d go with what I know. But now I'm starting to
wonder if a daemonized scanner might give me better
performance.
Looking forward to hearing everyone's thoughts on the matter!
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 3
ts to a minimum.
My manager has also expressed interest in "selective" virus protection,
perhaps on a per domain or even a per user basis.
Anyway, I'd love to see what you've got. Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // C
this memory pre-allocated, or is it allocated
on demand?
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This
g emails, for that matter) through to a test box running ClamAV from
CVS. Might put a bit more load on the production server, but it shouldn't break
it's back, unless it's already struggling.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Clev
ch will monitor
the script and restart it if it dies.
I have attached a plain text step-by-step HOWTO guide, roughly after the
style of Life With Qmail. It assumes that you already have clamd installed
and running properly.
Let me know if you like it.
--
Jesse Guardiani, Systems Administrator
W
the safest, most stable distribution
I can find.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
Thi
On Friday 12 September 2003 11:05, Odhiambo Washington wrote:
> * Jesse Guardiani <[EMAIL PROTECTED]> [20030912 17:48]: wrote:
>
> Hi Jesse,
>
> > clamd from clamav-0.60 dies ocassionally on me too. I run FreeBSD
> > 4.8-RELEASE on a Dell PowerEdge 4300. I have the
don't need to PING my clamd daemon, so I've never bothered.
>
> Thats all for now.
>
> Thanks guys
> Malcolm
> PS - I'm very impressed with clam over all. Thumbs up to the folks who
> put it together and keep it running.
I'll second that. I
md under DJB's daemontools package. My clamdctl script (after the fashion
of apachectl and qmailctl) properly handles the socket file cleanup and even
makes sure that if clamd dies it will be immediately restarted.
Check out this thread:
http://news.gmane.org/onethread.php?group=gma
#x27;s scanning
> our email.
I'm not 100% sure, but I _think_ it allows clamd to scan within MIME mail and
such. I just turned it on because it seemed like a good idea. I'm not sure if
it helps when using qmail-scanner or not. :)
--
J
Daniel Wiberg wrote:
> Jesse Guardiani wrote:
>
>>Darek M wrote:
>>
>>
>>>Hey guys, new member here, go easy on me.
>>>
>>>2. clamd dies on me on signal 11 (core dump). Is this a common issue?
>>>If so, is there a fix? Regardless o
Is the virusdb list functioning?
I'm not getting any updates from it.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingne
I have tested
most of my submissions by using the web based CGI submission
tool too:
http://www.gietl.com/test-clamav/
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423
testing...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This sf.net email is sponsored by:ThinkGeek
Welcome to
]
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http
ently. But ClamAV's current virus def for Worm.Gibe.F
seems to be faulty because it only catches about 50% of my Gibe-F viruses...
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559
1-000393DC8E02%40oakley.nyi.net%3E
For a complete clamd/daemontools install solution.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingnet.net
he clamav user to the FreeBSD password
database. You'll probably have to use different syntax/commands under a different
OS.
In addition, I've made a slight change at the bottom of the howto to better
indicate the end of the /usr/local/clamav/supervise/clamd/run file.
NOTE: I run this EXAC
le as possible.
The only thing I forgot to do was protect my email address
in the /usr/local/clamav/supervise/clamd/run script.
Thanks!
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v) 423-559-5145 (f)
http://www.wingne
--
> This SF.net email is sponsored by: SF.net Giveback Program.
> SourceForge.net hosts over 70,000 Open Source Projects.
> See the people who have HELPED US provide better services:
> Click here: http://sourceforge.net/supporters.php
>
Howdy list,
Is there a database anywhere that lists all the viruses
that forge addresses?
I'd like to prevent my server from sending out false
notification messages.
Thanks.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
42
McDonald, Dan wrote:
> -Original Message-
> From: Jesse Guardiani
>>Is there a database anywhere that lists all the viruses
>>that forge addresses?
>
> There may be, but can you react quickly to a new one?
If one exists, then yes, I can. I'm a programmer
McAfee up front, but McAfee is quite a bit cheaper than Sophos for the long
haul.
ClamAV is by far the biggest bang for your buck on an Open Source mail server.
--
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v)
Bill Shupp wrote:
Trog wrote:
On Mon, 2006-01-09 at 15:37 -0800, Bill Shupp wrote:
First, I would check the filesystem type of /tmp (or whatever you are
using). Make sure it is not sync'ed or journalling.
Next, I would investigate the pthreads libraries. If your system has
more than one to choo
[EMAIL PROTECTED] wrote:
Sam DeForest wrote:
<[EMAIL PROTECTED]>, uid 508) with qmail-scanner-1.25-st-qms
(clamdscan: 0.88/1235. spamassassin: 3.0.0. perlscan: 1.25-st-qms.
Clear:RC:0(220.175.180.80):SA:0(-1.2/5.0):
...
So, in my estimation, it looks to be that clamdscan is not using the
la
76 matches
Mail list logo
