jean-paul natola wrote:
I updated my ports and when when I install clamav it only brings me to
90_3 and upon running freshclam- it tells me to upgrade to 90.1
http://www.freshports.org/security/clamav/
Are you sure you updated your ports? It looks to me
like you still have 90_3 in the ports
Gerard Seibert wrote:
On Friday March 16, 2007 at 07:02:33 (AM) sergio wrote:
I tried to install new clamav on my freebsd-4.8. ./configure with
enable-experimental was good. but make ends with error code 1.
Clamav-0.90.1 is not installable on freebsd-4.8,yes?
Help please.
Versions of
Jerry Lee wrote:
> Hi Tomasz,
>
> Thank you for your respond and clue. I don't think that the softlimit is
> related to clamd. It is for qmail's smtp and pop3 services. Is there any
> other suggestions? Anything can help. I really appreciate it.
qmail-scanner is called during qmail's SMTP sessi
Charles Mckee wrote:
> Thank you for this information.
>
> However I have looked at the freshclam.conf file and there is no where I
> can designate a certain directory. We are on a closed network and there I
> have seen where freshclam tries to pull or even point to a DSN server or
> Mirror ser
Hello all,
This may be somewhat off topic as I think the problem may lie more with
simscan then clamav but people on this list probably have the most
experience with the interaction of the two.
I am trying to get simscan working on Solaris 10 (sparc) but I am
having issues when clamav finds a vir
It compiled on Solaris 10 (sparc) without any problems. It even appears
to have detected the endianness right. I have run a few messages through
it and it appears to detect things correctly. No warnings or error messages
in either the freshclam or clamd logs so far.
With respect to testing. Ar
Kaplan, Andrew H. wrote:
> Hi there --
>
> It appears the DNS server the server uses does not allow recursion.
> Is it possible to configure the freshclam.conf file to connect via
> the ip address of the database server, and if so what is the address
> to use? Thanks.
>
You would be better off
Dennis Peterson wrote:
> How are able to determine that? There's nothing in the connection
> information or in the message that identifies the source OS, hardware,
> or MTA. Everything in a message can be spoofed as can the sending
> system. The only thing you can be sure of is the IP you log d
Mishustin Alexey wrote:
> Hello,
>
> what's about my question? (I wrote 23 March)
>
> After the full system scan I've got console reports as follows:
>
> LibClamAV Warning: cli_utf16toascii: length < 2
>
> What does it mean? Is this a bug? How to fix the problem?
I am no expert but if I had to
Bas van Rooijen wrote:
> Thanks for the replies so far;
>
> however please note I already know the problem is ClamAV (hence i'm writing
> to this list..)
>
> Is there anyone who can answer my actual questions?
>
Comment out the check in the source and recompile?
___
Carlos Williams wrote:
> I am just guessing the automated process would not be essential until I
> can manually run freshclam and see it connecting to valid hosts and then
> update itself w/o any errors.
>
> What am I doing wrong?
>
It gives you a link in the log message that you should proba
People who may have problems compiling ClamAV 0.93 with the FreeBSD
ports on 4.11 may need to patch the port Makefile as I had to. I am
not sure if it affects other FreeBSD versions or not, I didn't try it.
--- Makefile.orig Wed Apr 16 10:59:51 2008
+++ MakefileWed Apr 16 11:37:41 2008
James Kosin wrote:
> ~ SPARC Options
> ~-
> ~ -pthreads
> ~ Add support for multithreading using the POSIX threads library.
> ~ This option sets flags for both the preprocessor and
> linker. This
> ~ option does not affect the thre
James Kosin wrote:
>
> The -pthread should only be needed on IBM RS/6000 and PowerPC platforms.
> SPARC has their own option and everyone else should follow into the -l
> category.
>
I suppose I should clarify the architecture. This was done on an x86.
Steven
___
Naomi Hospodarsky wrote:
> So I'm not sure where the disconnect is happening between the two
> programs; if anyone has any ideas, I'd be very glad to hear them!
I am not up to speed on AIX so I may have some wrong presumptions
but shouldn't your header files by in /usr/local/include and your
libra
Naomi Hospodarsky wrote:
> Okay, that makes sense. I tried copying the lib files over to
> /usr/local/lib as you suggested, and am now getting this error in
> config.log
>
> configure:15256: checking for libgmp
> configure:15286: cc -qlanglvl=extc89 -o conftest -g
> -I/usr/local/include conftest.c
Ian Eiloart wrote:
> If you want our help with this, then please say (a) where the release can
> be found, and (b) where a changelist can be found.
>
http://downloads.sourceforge.net/clamav/clamav-0.93rc1.tar.gz
ChangeLog is in the tar file.
Steven
_
Christopher X. Candreva wrote:
> On Thu, 22 May 2008, [EMAIL PROTECTED] wrote:
>
>> http://downloads.sourceforge.net/clamav/clamav-0.93rc1.tar.gz
>
> That's an old version -- 0.93rc1 not 0.93.1rc1
>
Doh, thats what I get for responding to email before being fully
coherent in the morning. Misse
Dennis Peterson wrote:
> Why do you suppose this is happening?
>
Some long shot ideas...
Two freshclam processes updating different definition databases?
An errant crontab entry running freshclam to different definition
databases?
Steven
___
Help us
Thierry Besancon wrote:
> If you can create such a patch, why can't you apply it against a 0.93.1
> release and name the result 0.93.2 ? The bug is identified, isn't it ?
Then the people who aren't affected by it get yelled at by their freshclam
daemon that they are out of date. I am just finish
Sim wrote:
>> If you are able to start debugging the code then patching it should be
>> a trivial matter and I don't see why it is such a big deal.
>>
>
> Hi Steven,
>
> the bug is identified and fixed.
>
> Why you are asking to debug it?
You stated that you started debugging the code. I was j
Thierry Besancon wrote:
> If you had to be affected by all bugs to upgrade, you wouldn't update
> that much...
>
Upgrades aren't just performed for bugs. They are also performed for
improvements. In the case of 0.93.1 the handling of many different
file types was improved as well as a few minor
metamorph wrote:
> Problem with ClamAV plugin for spamassassin:
>
> Spamassassin/Clamav/Ubuntu/PHP5/Apache2/citadel/
>
> I just installed spamassasin and tested it with gtube and it worked, but
> when I tried to install clamav it still lets the EICAR files through. I
> read through old posts an
metamorph wrote:
> I am very new to perl, how would you suggest I add clamav.pm to @INC (ln
> -s?)?
>
Google "perl @INC". There is quite a bit of info out there on how to do it.
___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.
jean-paul wrote:
> I upgraded to the lates version today,
>
> and now Im getting this error
>
>
> any help out there?
Does the directory exist and is it writable by whatever
user you are running ClamAV as?
Steven
___
Help us build a comprehensiv
Parveen Malik wrote:
> Hi,
> I am first time user for clamav antivirus..
> I tried to run update the database for claimav result is :
> freshclam -d
>
> ERROR: Please edit the example config file /etc/freshclam.conf.
>
> WARNING: You must specify at least one database mirror.
> Config file is alr
Parveen Malik wrote:
> I setup under mentioned values:
>
> DNSDatabaseInfo current.cvd.clamav.net
>
>
> # Uncomment the following line and replace XY with your country
> # code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
> DatabaseMirror db.us.clamav.net
>
So did it wor
David F. Skoll wrote:
> G.W. Haywood wrote:
>
>>> Currently, we accept all infected mail, and quietly quarantine it.
>
>> May I suggest that you quarantine it, BUT STILL REJECT IT after it
>> has been read (and recorded) in its entirety?
>
> No, please don't do that for viruses. If they are bei
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
>> If done during the SMTP conversation the only thing that is going to
>> see backscatter is the thing that sent it.
>
> Which is why I qualified my reply with "if the sending relay is a valid
> SMTP client."
Maybe we are just arguing semantics
Parveen Malik wrote:
> Hi all,
>
> I need to open ports for Clamav database update, but since yesterday it
> seems that IP address are changing every hour.. Can you guys please let
> me know what should I do to resolve this issue.
> Sending you ping output.
> [EMAIL PROTECTED] root]# ping db.us.cl
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
>>> Which is why I qualified my reply with "if the sending relay is a valid
>>> SMTP client."
>
>> Maybe we are just arguing semantics but anything that connects to
>> my mail server and speaks RFC821 is valid. I might not like what
>> it feeds
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
> [...]
>
>> What backscatter? If done at SMTP the only person that should be
>> notified is the sender.
>
> I see. And it's impossible for a virus to forge MAIL FROM:, is it?
No, is is trivial for anyone to forge "mail from" headers but that
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
>> No, is is trivial for anyone to forge "mail from" headers but that is
>> irrelevant when virus filtering is done at the SMTP level. You don't
>> send the rejection to the address in the "mail from." You send the
>> rejection to the server/cli
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
>> No, I did not say that. I said it was trivial. I am just pointing out that
>> it is irrelevant while the SMTP conversation is still going on. It is
>> impossible(mostly) to forge the IP the message is being sent from if there
>> is a live SM
David F. Skoll wrote:
> [EMAIL PROTECTED] wrote:
>
>> No need to be condescending about it. I have no problem taking it off
>> list and explaining how you are mistaken.
>
> OK, look. I guess I need to spell it out for you.
>
> End-user PC has virus. Virus does this:
>
> telnet isps-smtp-serv
rick pim wrote:
> David F. Skoll writes:
> > [EMAIL PROTECTED] wrote:
>
> i'm far from an expert but at some level i believe that you're both
> right. the real question boils down (i think) to "who is trying to deliver
> this piece of unwanted email?"
>
> if it's a Real MTA, then kicking back a
Charles Gregory wrote:
> On Fri, 8 Aug 2008 [EMAIL PROTECTED] wrote:
>>> telnet isps-server 25 ... HELO bogus ... MAIL FROM:<[EMAIL PROTECTED]>
>>> telnet victims-server 25 ... HELO isps-server ... MAIL FROM
>>> If victim's SMTP server fails the DATA with a 5xx code, then
>>> backscatter goes [
Charles Gregory wrote:
> On Fri, 8 Aug 2008 [EMAIL PROTECTED] wrote:
>>> telnet isps-server 25 ... HELO bogus ... MAIL FROM:<[EMAIL PROTECTED]>
>>> telnet victims-server 25 ... HELO isps-server ... MAIL FROM
>>> If victim's SMTP server fails the DATA with a 5xx code, then
>>> backscatter goes [
[EMAIL PROTECTED] wrote:
> Charles Gregory wrote:
>> On Fri, 8 Aug 2008 [EMAIL PROTECTED] wrote:
telnet isps-server 25 ... HELO bogus ... MAIL FROM:<[EMAIL PROTECTED]>
telnet victims-server 25 ... HELO isps-server ... MAIL FROM
If victim's SMTP server fails the DATA with a 5xx co
Charles Gregory wrote:
> On Fri, 8 Aug 2008 [EMAIL PROTECTED] wrote:
>> I have been at the other end of backscatter and it is by no means fun
>> but when it happens I am fully capable of taking measures against as I
>> would any other spam/virus source. This is where RBLs come in handy.
>
> How w
[EMAIL PROTECTED] wrote:
> I've upgraded many times in the past without this problem. In a nutshell,
> I just did a configure, make and make install without uninstalling
> previous versions like I always have. This time, while clamav starts and
> runs with no errors, even in Verbose mode, it j
Vladimir wrote:
> Hi.
>
> FreeBSD 5.4-RELEASE-patched-p8
> ClamAV 0.94 from ports
>
> Clamd does not work. When starting, i get this in logs:
> However, clamd is not running and is not in processes list ("ps ax | grep
> clamd" shows
> nothing). There are no errors and warnings of any kind.
>
>
Vladimir wrote:
> A lot of lines like
> #0 0x28141268 in _pthread_sigmask (how=3, set=0xbfbfeb50, oset=0x0)
> at /usr/src/lib/libthr/thread/thr_sig.c:60
> #1 0x281a5a1a in sigprocmask () from /usr/lib/libpthread.so.1
>
Did you change the PTHREAD_LIBS in the ports Makefile at all? I
unfortu
Rob MacGregor wrote:
> On Tue, Sep 23, 2008 at 08:37, Sam Lin <[EMAIL PROTECTED]> wrote:
>> Hello list,
>>
>> i try pkg_add -r clamav and it's show me the package are the same
>> Fetching
>> ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/Latest/clamav.tbz
>> pkg_add: package 'clama
Rob MacGregor wrote:
> On Tue, Sep 23, 2008 at 14:30, <[EMAIL PROTECTED]> wrote:
>> Or you can just delete --enable-gethostbyname_r from the CONFIGURE_ARGS
>> section of the port Makefile and everything will work fine. I would
>> advise that you stick with 6.3 as it has a longer support cycle tha
Vladimir wrote:
>>> A lot of lines like
>>> #0 0x28141268 in _pthread_sigmask (how=3, set=0xbfbfeb50, oset=0x0)
>>> at /usr/src/lib/libthr/thread/thr_sig.c:60
>>> #1 0x281a5a1a in sigprocmask () from /usr/lib/libpthread.so.1
>>>
>
> kzc> Did you change the PTHREAD_LIBS in the ports Makefile
Hans Morten Kind wrote:
> When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1,
> our solaris servers started dumping cores. We are experiencing the same
> behavour with simple .doc-files also on 0.94 and the latest devel-release.
>
> hdr.m_area is memcpy'd to &hdr with hdr_siz
Hans Morten Kind wrote:
> On Thu, Oct 16, 2008 at 11:21:25AM -0600, [EMAIL PROTECTED] wrote:
>> Hans Morten Kind wrote:
>>> When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1,
>>> our solaris servers started dumping cores. We are experiencing the same
>>> behavour with simple
Hans Morten Kind wrote:
> setenv CC "/opt/SUNWspro/bin/cc -m64"
> setenv LDFLAGS "-L/opt/lib/64 -R/opt/lib/64 -lz -lgmp -L/lib/64 -R/lib/64
> -L/usr/lib/64 -R/usr/lib/64"
> setenv CFLAGS "-xO2 -g"
Hrmm. I just let the configure script find the libs and I
used gcc to compile. So pretty much
Juergen Dankoweit wrote:
> Because the ports tree is unupgradable I must use the original source
> from the web site. I compile clamav with the following options:
> ./configure --disable-clamuko --disable-ipv6
Bah. Upgrade your ports and edit the port Makefile. Delete
--enable-gethostbyname_r u
Odhiambo Washington wrote:
Hello List,
Perhaps I missed the discussion, so someone can help me out.
The clamav port on FreeBSD has been made to use OpenLDAP as
a dependency by default. I have just written to the person
concerned, but perhaps I am mistaken.
Can someone tell me what they use Open
Odhiambo Washington wrote:
#grep LDAP /usr/ports/security/clamav/Makefile
.if !defined(WITHOUT_LDAP) && exists(${LOCALBASE}/lib/libldap.so)
USE_OPENLDAP= yes
To me this means that if you don't have WITHOUT_LDAP defined and
libldap.so exists it will use LDAP. So you already have to
have LDAP i
riwanlky wrote:
Hi All,
Sorry if this questions had been asked.
I am using OpenBSD 3.9, I will like to know for could I rotate
my clamd.log. Currently my clamd.log is as big as 7 MB,
however in my clamd.conf I am using default. Which suppose
to be 1 MB.
Thanks in advance.
Brgds,
Riwan
man
Jay West wrote:
Hopefully someone can nudge me in the right direction, I feel like I'm
grossly missing something here.
Platform: FreeBSD 6.1, Clamav 0.88.2, Sendmail 8.13.6
I do not have LogClean defined in my clamav config file. According to
the docs, the default is disabled. However, my log
jef moskot wrote:
On Sun, 27 Aug 2006, Bit Fuzzy wrote:
As for the situation, we've been using ClamAV for going on 3 years now,
and I have never (I repeat never) seen this occur.
Occasionally there are major virus flare-ups (and often there are phishing
scams and such) that occur before an app
jef moskot wrote:
I have a small script I modify to do the job of lifting the offending
messages out of the mbox files. On a large scale, there's the obvious
problem of modifying files that could be in use or files that the user
could modifying during the stripping process.
I can monitor these
Jim Maul wrote:
You seem to be missing the point here. Nowhere that i saw did anyone
say that they are scanning the mailboxes INSTEAD of at smtp time. This
mailbox scanning is in addition to smtp scanning. I think anyone could
agree that additional scanning is beneficial (although not always
Jim Maul wrote:
Perhaps, but i read it differently.
Fair enough.
But anyway, why would you want to perform additional virus scanning of
mailboxes if it is all scanned upon arrival anyway? The only reason
I could think is if virus definitions were updated after some malware
had already been
[EMAIL PROTECTED] wrote:
What is the best solution to ensure reliable updates without manual
intervention? Just ensure that the cron job kills any old instances of
freshclam before running a new one?
Why not just run it as a daemon?
Steve
___
h
Chuck Swiger wrote:
Only, when they use a mechanism like ports/pkgsrc/dselect/yum/etc to
update the installed version of freshclam, that mechanism leaves the old
version of the daemon running rather than stopping and restarting
freshclam to pick up the new version.
This problem depends upon
[EMAIL PROTECTED] wrote:
On Wed, 6 Sep 2006, SM wrote:
I agree. MailScanner is totally configurable in this regard, and is
normally set to trap known viruses and inform neither "sender" nor
recipient. If a virus is rejected at SMTP time then the sending server is
likely to try to deliver th
Jan-Pieter Cornet wrote:
But "helping" the virus by allowing it to spread to a secondary
target (which most viruses now put in the "MAIL From" field), isn't
good either.
I don't think you are really helping it by rejecting an email.
There are pretty much two things that can happen.
1 - The send
Wilson Kwok wrote:
If I not install the GPM that will affect the clamav ?
Thank
Wilson
I don't think it will affect the operation of clamav but
you won't be able to verify that you have the authenticate
virus definitions provided by clamav.
Steve
___
mcd wrote:
Any help to reduce the scan time would be appreciated.
I am not sure what kind of tools Windows has for this type of thing
but you could always log the time it takes to scan each file and
adjust your exclude list accordingly
or
even better you could install some type of file audi
mcd wrote:
Basically I want to continue on with what some of the people on this list
were saying about using tripwire (or something similar) to just scan files
on a system that have changed. I wouldn't want to call clamscan multiple
times each with one file, but rather call it once with a big lis
Facundo Barrera wrote:
Hi list:
First post, hope be lucky...
Here's the deal, i upgraded clamav to the latest version 0.88.4 from
the 0.88.3, but i receiving an error from the logs:
clamd daemon 0.88.3 (OS: linux-gnu, ARCH: i386, CPU: i686)
WARNING: Version mismatch (clamd: 0.88.3, libc
Facundo Barrera wrote:
could you be more specific, which binaries should i delete? which
one's should i look for?
Thanks!
Before we get to far into finding the binaries you did
restart the clamd process after the upgrade right?
Since it is clamd that is reporting to be an old version
you shou
Benjamin Adams wrote:
I'm trying to get the load down on my mail server but clamscan keeps
coming up and using resources.
clamav /usr/bin/clamscan --stdout --disable-summary -r
/var/amavis/amavis-20060920T103310-24504/parts
clamav amavisd (ch1-24545-01)
clamav freshclam -d -D -pfreshcla
Richard Feldmann wrote:
The configure command dies on:
checking whether we can locate the clamav db path... no
configure: error: Unable to find your clamav databases, specify --enable-cl=
amavdb-path.
And I've specified the location as "--enable-clamavdb-path=3D/usr/share/cla=
mav"
Here's wha
R. Steven Rainwater wrote:
Or perhaps there's way to have clamav-milter and clamd automatically
restart when they die?
Daemontools?
Steve
___
http://lurker.clamav.net/list/clamav-users.html
First make sure that the binary is still in the place
that simscan is looking for it. Second make sure
that simscan is in the clamav group (assuming you
aren't running as root.)
Steve
[EMAIL PROTECTED] wrote:
Hey,
We are running into a strange error with clamd.
On our logs we see the fol
Robert Isaac wrote:
Yesterday I installed 0.88.7 on our server running RHESL-4 using the rpms
from DAG, previously using 0.88.6. Our LogWatch file this morning shows:
**Unmatched Entries**
clamd shutdown succeeded
clamd shutdown failed
clamd daemon 0.88.7 (OS: linux-gnu, ARCH: i386, CPU: i386) B
Robert Isaac wrote:
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
[EMAIL PROTECTED]
Sent: 13 December 2006 18:55
To: ClamAV users ML
Subject: Re: [Clamav-users] 0.88.7 possible error
Robert Isaac wrote:
Yesterday I installed 0.88.7 on our server run
Robert Isaac wrote:
There was only one instance running. Killed it and restarted it. Then in
today's LogWatch:
**Unmatched Entries**
clamd shutdown failed
clamd daemon 0.88.7 (OS: linux-gnu, ARCH: i386, CPU: i386) Bound to address
127.0.0.1 on port 3310 clamd startup succeeded Portable Executab
Doug Hubbard wrote:
I am starting to think my systems have been blacklisted for some reason.
They have all (3) been set up according to the instructions listed on
the web site, but all are failing to get updates.
How do I
1) find out for certain if I am blacklisted? (none of the machines in
qu
John Madden wrote:
Any suggestions here? Being like 6 days behind on virus definitions is
an uncomfortable feeling. Since the manual wget works, can I build the
database manually somehow until this is otherwise resolved?
There is no database building involved. The copy you get from wget
is
Bryan Vest wrote:
We have a mail server that gets filtered through postini. But for some
reason management has decided to open it up to connections other than
postini. Is there anyway that the clamav-milter can be told to only scan
mail that was not relayed through postini? I have searched a go
Miguel Rois wrote:
Hi all :
When clamav detect a virus and I put it in quarintine, the program carry
ALL file, and no the infected file.
For example the file Inbox of my e-mail, had a virus in 85 M of messages, ¡
one virus !. When I put it in quarintine, the program carried ALL the file.
It's no
Florent Gilain wrote:
Sory, i just have found the HOWTO : http://wiki.clamav.net/Main/SimScan
But, one more question, how can i know if Pre-Requites are ok on my server
(QMAILQUEUE patch).
You could always try feeding something to simscan with QMAILQUEUE(from the
simscan wiki):
QMAILQUEUE=/p
carren stuart wrote:
At last - someone who actually gets it. Thank you Nick!
For the rest of you, I shall repeat - my timezone AND system time is set
correctly.
Ugg, as much as I hate to continue this OT subject. Something with your time
is jacked. Whether it be your time or timezone I don'
80 matches
Mail list logo
