load increase normal (from 4-5 average to 9-11 average) or is
there something i can do to drop the overhead?
cheers
Scott Ryan
Systems Administrator
Telkom Internet
South Africa
signature.asc
Description: This is a digitally signed message part
Fri, 2004-03-12 at 04:18, Scott Ryan wrote:
> > Hello all, I have upgraded clamav from 0.55 to 0.67-1 so I can now catch
> > the bagle-passwd worm. It works and it catches the virus, but I have
> > noticed a significant increase in the load on the machine. I am running
> >
I am running 0.67-1 and was looking to get a copy of the virus to test
if clamd catches it. where would i be able to get a copy of it from?
Thanks
Scott Ryan
Telkom Internet
South Africa
signature.asc
Description: This is a digitally signed message part
for it to be parsed
through qmail scanner before hitting the queue?
Thanks in advance
Scott Ryan
---
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to
deliver hi
__
> Clamav-users mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/clamav-users
- --
Kindest Regards,
+-+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Intern
not My.Doom.o -
My question is, how do i get clamav to identify these files as a virus?
Many thanks
--
+-----+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Internet - SA
+-+
Email: [EM
What about sheep ?
On Wednesday 28 July 2004 09:38, Andrzej Kukula wrote:
> Matt:
> > > On Tue, 2004-07-27 at 13:28, Kevin Spicer wrote:
> > > > On Tue, 2004-07-27 at 16:26, Scott Ryan wrote:
> > > > > I have not submitted any virii (correct word?)
line 163
> *** Error code 1
>
> can anyone help me with this probs??
>
> TIA
--
+-+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Internet - SA
+-+
Email
bish that are harmless as they are not executable.
>
> This includes files that are zipped and doubly zipped.
>
> -trog
--
+-+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Internet - SA
+
t; ___
> Clamav-users mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/clamav-users
--
+-+
(0> Scott Ryan
//
email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
> ___
> Clamav-
s of a million mails a day and
have no issues with it.
--
+-----+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Internet - SA
+-+
Email: [EMAIL PROTECTED]
Ce
On Monday 02 August 2004 17:15, Julio E. Gonzalez P. wrote:
> I just want to share this bash script to generate virus statistics. I
> know is not perfect, but do the work.
>
> Hope it helps someone.
>
> Julio.
Here is another
Again, not perfect - but will do a job.
virus_stats.pl
Description: Per
e or clam
would not have been able to capture the virus when run manually.
Does anyone have any ideas or should I submit this as a bug?
Many thanks
--
+-+
(0> Scott Ryan
//\ Unix/Linux Systems Engineer
V_/_Telkom Intern
i am picking up thousands of mails a day - like
i said earlier, i even have records in my logs that clam is catching some
my.doom.M viruses.
> On Fri, 3 Sep 2004 07:13:53 +0200, Scott Ryan <[EMAIL PROTECTED]>
wrote:
> > I had an issue with this a while back which was fixed by upgradi
On Friday 03 September 2004 11:18, Rob MacGregor wrote:
> On Fri, 3 Sep 2004 10:26:49 +0200, Scott Ryan <[EMAIL PROTECTED]>
wrote:
> > No because I dont use mbox format. I cat the email message and pipe it
> > through clamdscan. It picks up that it has to scan scanning mail
On Friday 03 September 2004 16:42, Chris Meadors wrote:
> On Fri, 2004-09-03 at 11:47 +0200, Scott Ryan wrote:
> > Maybe you want to read the mail i sent again.
> > I use clamdscan not clamscan
> >
> > # man clamdscan
>
> Then do you have the "ScanMail"
On Friday 03 September 2004 07:13, Scott Ryan wrote:
> I had an issue with this a while back which was fixed by upgrading to
> latest devel and then eventually 0.75-1.
> I run qmail-scanner which in turn calls clamdscan. If i cat the message and
> pipe through clamdscan manually, clam
4 x Dell 6650s - 4 HT Xeons.
It used to be a CPU hog until we started using clamdscan instead of
clamscan :S
On Saturday 11 September 2004 11:44, Odhiambo Washington wrote:
> Anyone running ClamAv in an SMP server?
> Any exploits (good news) that you can share about running it under
> such a
On Monday 13 September 2004 23:13, Adam Bernstein wrote:
> Howdy. We have a strange problem: We're running the latest
> stable, 0.75.1, with virus definitions updated via freshclam
> every hour (the latest log entry shows "version 488". We have
> a virus that keeps getting through, but it is rec
On Monday 20 September 2004 21:52, Daniel Alberto Cañas wrote:
> On Sep 20, 2004, at 12:41 PM, Matt Gourley wrote:
> > Niek wrote:
> >> On 9/20/2004 4:32 PM +0200, Matt Gourley wrote:
> >>> Hi all,
> >>>
> >>> I've been trying to get ClamAV to log via multilog so that I can
> >>> generate reports v
gards,
+---+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+---+
Email: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
Cell: +27-721164832
Wor
On Wednesday 22 September 2004 12:28, Brian Morrison shaped the electrons to
say:
> On Wed, 22 Sep 2004 10:37:31 +0200 in
> [EMAIL PROTECTED] Scott Ryan
>
> <[EMAIL PROTECTED]> wrote:
> > I am investigating the possibility of using a Unix socket as opposed
> > to
r the url
Kind regards,
+------+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+--+
Email: [EMAIL PROTECTED]
[EMAIL PROTECTED]
[EMAIL PROTECTED]
Cell: +27-721164832
W
it means something else
--
Kind regards,
+--+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+--+
He who controls the past, controls the future,
He who controls
problem went away, but i still get the
warning telling me to upgrade...
is there a release i am missing ??
--
+--+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Afr
.
--
+--+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+--+
He who controls the past, controls the future,
He who controls the present, controls the p
On Tuesday 19 October 2004 16:34, Trog shaped the electrons to say:
> On Tue, 2004-10-19 at 15:07, Scott Ryan wrote:
> > I saw on my monitoring application just now that clamav was outdated and
> > that i must update immediately. I was running 0.80rc3, and the moment I
> > g
On Tuesday 19 October 2004 16:38, Tomasz Kojm shaped the electrons to say:
> On Tue, 19 Oct 2004 16:09:54 +0200
>
> Scott Ryan <[EMAIL PROTECTED]> wrote:
> > ClamAV databases updated (2004.10.19 12:59 +): daily.cvd
> > version: 540
> >
> > Submi
d of clamdscan. We send/receive over a million mails a day and
the cpus were sitting at 100% constantly. The first thing i did was to change
to clamdscan and cpu usage dropped unbelievably.
--
+------+
(0> Scott Ryan
//\ Senior Unix/Linux Engine
27;s documentation, and then don't break it by
> linking clamdscan to clamscan.
>
> 2. If you want to use clamscan rather than clamdscan (for no reason,
> other then to send your CPU load to 100%, as per this thread), configure
> qmail-scanner to do so, it has a configure option f
Same here. We use qmail and find that 128Mb Raid controller for the queue dir
increase the I/O immensely. Reiserfs helps as well.
--
+--+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+
On Tuesday 26 October 2004 17:57, Jim Maul shaped the electrons to say:
> Scott Ryan wrote:
> > On Tuesday 26 October 2004 09:52, Trog shaped the electrons to say:
> >>On Tue, 2004-10-26 at 03:45, Eric Worthy wrote:
> >>>This is a vanilla install off qmailrocks.org s
On Tuesday 26 October 2004 18:47, Jim Maul shaped the electrons to say:
> Scott Ryan wrote:
>
>
>
> > What are we arguing about here? I just know in my experience that you are
> > seriously shooting yourself in the foot by using clamscan to scan all
> > mails. Trog&#
this issue is causing me a bit of
problem.
any help would be appreciated.
--
+--+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_Telkom Internet - South Africa
+--+
He who controls the p
On Wednesday 27 October 2004 21:48, Todd Lyons shaped the electrons to say:
> Scott Ryan wanted us to know:
> >I am having a slight problem which appears to have stemmed from swapping
> > from tcp sockets to unix sockets. Every now and again, and across 5
> > identical servers
On Wednesday 27 October 2004 22:27, Todd Lyons shaped the electrons to say:
> Scott Ryan wanted us to know:
> >> How many threads do you have set in clamd.conf?
> >
> >Ah. This could very well be the issue. I have threads set to 200, but it
> > could be possible tha
if any of you are ever in South Africa, beers are on me.
--
+------+
(0> Scott Ryan
//\ Senior Unix/Linux Engineer
V_/_ Telkom Internet - South Africa
+--+
He who controls the past, controls the future,
He who
On Wed, 2004-11-03 at 09:48 +1300, Jason Haar wrote:
> Hi there
>
> I think the TCP option needs some more explicit documentation, as I have
> begun seeing RPMs of clamav where the Socket option is *disabled* and the
> TCP option is *enabled* as the defaults.
>
> As far as I'm aware, that is *not
..Zip module failure ERROR
It also may be worth noting that I get the following errors as well.
.MS CAB module failure ERROR
.omsa.net-2004.11.07.02.00.tar.gz: Input/Output error ERROR
.LibClamAV Error: cli_untar: unknown type flag X
.RAR module failure ERROR
Something to do with
that somthing happens to clamd and I would appreciate any
pointers or advise for further information if required.
Many Thanks
--
Scott Ryan
Telkom Internet
___
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
On Tuesday 30 November 2004 14:14, Trog wrote:
> On Tue, 2004-11-30 at 12:04, Scott Ryan wrote:
> > I am using clamdscan (clamav 0.80 - RHEL3) on 5 very intensively used
> > mail servers and generally, I have no issues and it works wonderfully.
> > But however, every now and
spamasssasin + clamav. Simscan reject spams and virus at smtp level which
> i dont feel there is a need to filter the spams. So maildrop is left out on
> this setup.
>
> ___
> http://lists.clamav.net/cgi-bin/mailman/listinfo
On Wednesday 05 January 2005 14:59, Deon de Villiers wrote:
> Hi
>
> We are experiencing this as well.
>
> How stable is the current CVS version? Is it OK to use in a busy
> production environment? (I hope I am not asking a silly question...,
> but I need to get a fix for this asap).
We moved to
7;rtfm' and check the
clamscan man page :S
--
Scott Ryan
Telkom Internet
___
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
ytes):
> >
> > All the problem files I've had are Powerpoint and Word files. For the
> > Powerpoint files it was a common background image.
>
> P900\Beyonce Knowles - Crazy In Love (2).wav: Exploit.W32.MS05-002 FOUND
> p900\Evanescence - Bring Me To Life - Daredevil
> competition if they couldn't bully them or force them out some other
> way. They love that monopoly thing.
>
> Go get 'em Bill ! Lets see how many times your anti-virus solution
> crashes when you demo that at a show ;-) Yep I'd trust M$ with the
> security o
Can anyone shed some light on this / offer some advice, as obviously we want
to keep up with the latest stable version. I can provide the mail if anyone
wants to examine it further.
Many thanks
Scott Ryan
Telkom Internet
___
http://lists.clamav.net/cgi
ork around for these types of mails?
regards
--
Scott Ryan
Telkom Internet
___
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
On Wednesday 16 February 2005 17:34, Nigel Horne shaped the electrons to say:
> On Wednesday 16 Feb 2005 15:15, Scott Ryan wrote:
> > On Wednesday 16 February 2005 16:26, Nigel Horne shaped the electrons to
say:
> > > On Wednesday 16 Feb 2005 14:18, Ted Fines wrote:
> &
On Wednesday 16 February 2005 18:43, Tomasz Kojm shaped the electrons to say:
> On Wed, 16 Feb 2005 17:51:28 +0200
>
> Scott Ryan <[EMAIL PROTECTED]> wrote:
> > I will just have to allow these types of mails to go unscanned. Four
> > minutes to scan 1 will cause a DOS.
ut MailMaxMimeDepth and MailBlockMax directives ? Most other
> scanners I've used default to block any message with over 10 levels of
> mime nesting, maybe something like 25 is a good default though.
I even think that 25 is too much...
--
Scott Ryan
Telkom Internet
_
enabled.
2005-02-22 14:32:58.524754500 OLE2 support enabled.
2005-02-22 14:32:58.529606500 HTML support enabled.
2005-02-22 14:32:58.540238500 Self checking every 300 seconds
--
Scott Ryan
Telkom Internet
___
http://lurker.clamav.net/list/clamav
On Tuesday 22 February 2005 16:32, Matt Fretwell shaped the electrons to say:
> DisableDefaultScanOptions
A prime example of rtfm...
thanks.
--
Scott Ryan
Telkom Internet
___
http://lurker.clamav.net/list/clamav-users.html
On Wednesday 16 February 2005 14:35, Scott Ryan shaped the electrons to say:
> Hi list, I have posted before about an issue with clamd hanging and
> yesterday we finally managed to find out what the underlying problem was.
> We came across an 800k mail that we initially thought was caus
On Thursday 24 February 2005 11:29, Yatin Shah (QualiSpace, Sales) shaped the
electrons to say:
> Thank You!
>
> Thank you very much for mailing me. I will definitely check your mail and
get back to you. Meanwhile, please note:
> >>If you have any support related query, please send an email to
gentoo-announce] [ GLSA 200506-23 ] Clam AntiVirus: Denial of Service
Vulnerability
Sorry if this has been discussed before:
I do not see anything on the ClamAV website indicating the status of this
potential DoS or whether is rectified or even no applicable. Can anyone shed
some light on this
This one time, at band camp, Chris Hannam wrote:
> Hi,
> I`m running Clam AV 0.87 and have noticed some poor performance when
> scanning large (20Mb+) Power Point presentations. These scans can take
Of course it will take long to scan files of that size.
> upwards of 3 minutes. I had similar issu
even used tcpdump to see if there was
anything happening, but still nothing.
Any ideas would be greatly appreciated.
--
Regards,
Scott Ryan
Telkom Internet
-
Good judgement comes with experience.
Unfortunately, the experience
usually comes from bad
?
Everything would be a whole lot easier...
--
Regards,
Scott Ryan
ISP Systems Development & Integration Specialist
Telkom Internet
-
Good judgement comes with experience.
Unfortunately, the experience
usua
On Friday 18 August 2006 16:19, Jim Maul wrote with regard to - Re:
[Clamav-users] Clamav Uninstall :
> Dennis Peterson wrote:
> > Scott Ryan wrote:
> >> On Friday 18 August 2006 06:02, Robert wrote with regard to - Re:
> >>
> >> [Clamav-users] Clamav
On Friday 18 August 2006 16:27, Dennis Peterson wrote with regard to - Re:
[Clamav-users] Clamav Uninstall :
> Jim Maul wrote:
> > Dennis Peterson wrote:
> >> Scott Ryan wrote:
> >>> On Friday 18 August 2006 06:02, Robert wrote with regard to - Re:
> >>
On Friday 18 August 2006 16:43, Dennis Peterson wrote with regard to - Re:
[Clamav-users] Clamav Uninstall :
> Scott Ryan wrote:
> > On Friday 18 August 2006 16:27, Dennis Peterson wrote with regard to -
> > Re:
> >
> > [Clamav-users] Clamav Uninstall :
> >> J
63 matches
Mail list logo
