Re: [Clamav-users] Netsky P not being blocked, using 0.70-rc
On Sat, 2004-04-10 at 16:49, Jeff Ramsey wrote: > On Apr 10, 2004, at 9:27 AM, Colin A. Bartlett wrote: > > > Jeff Ramsey Sent: Friday, April 09, 2004 4:23 PM > > > >> I have done some further testing, and I am blocking Somefool and > >> Somefool.B, but I am not blocking variant P. > > > > FWIW, this same thing happened to me when I upgraded from Clam .60 to > > the > > latest version. Apparently I installed it in a different place so > > there were > > two version of my daily updates and it wasn't using the new one. Are > > you > > sure your virus signatures are being updated and include the SomeFool.P > > variant? Run "sigtool --list | grep SomeFool" to see if it's listed. > > > > cheers, > > Colin > > > I ran the command above, and here are the results: > > Worm.Somefool > Worm.Somefool.B > Worm.Somefool.B.2 > Worm.Somefool.D > Worm.Somefool.E > Worm.Somefool.F > > These ones are all working. How can I get freshclam to get the P > variant file? > > Thanks, > Jeff As has been implied earlier, double check your /etc/clamav.conf or /etc/clamd.conf and verify the DatabaseDirectory matches the DatabaseDirectory entry in /etc/freshclam.conf. Also, make sure that when freshclam is run, it is using the freshclam.conf file or explicitly sets the database directory via the command line to the place you think it should be. Here's what mine has in it for SomeFool: Worm.SomeFool.Gen-unp Worm.SomeFool.O Worm.SomeFool.P Worm.SomeFool.P-dll Worm.SomeFool.Q Worm.SomeFool.N Worm.SomeFool.R Worm.SomeFool.Q.2 Worm.SomeFool Worm.SomeFool.B Worm.SomeFool.B.2 Worm.SomeFool.D Worm.SomeFool.E Worm.SomeFool.F Worm.SomeFool.Gen-1 Worm.SomeFool.Gen-2 Worm.SomeFool.I Worm.SomeFool.K Worm.SomeFool.L Worm.SomeFool.M -Bill --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Netsky P not being blocked, using 0.70-rc
On Sat, 10 Apr 2004 16:49:52 -0700 Jeff Ramsey <[EMAIL PROTECTED]> wrote: > > On Apr 10, 2004, at 9:27 AM, Colin A. Bartlett wrote: > > > Jeff Ramsey Sent: Friday, April 09, 2004 4:23 PM > > > >> I have done some further testing, and I am blocking Somefool and > >> Somefool.B, but I am not blocking variant P. > > > > FWIW, this same thing happened to me when I upgraded from Clam .60 > > to the > > latest version. Apparently I installed it in a different place so > > there were > > two version of my daily updates and it wasn't using the new one. Are > > > > you > > sure your virus signatures are being updated and include the > > SomeFool.P variant? Run "sigtool --list | grep SomeFool" to see if > > it's listed. > > > > cheers, > > Colin > > > I ran the command above, and here are the results: > > Worm.Somefool > Worm.Somefool.B > Worm.Somefool.B.2 > Worm.Somefool.D > Worm.Somefool.E > Worm.Somefool.F My output is: [EMAIL PROTECTED]:~$ sigtool -l | grep -i somefool Worm.SomeFool Worm.SomeFool.B Worm.SomeFool.B.2 Worm.SomeFool.D Worm.SomeFool.E Worm.SomeFool.F Worm.SomeFool.Gen-1 Worm.SomeFool.Gen-2 Worm.SomeFool.I Worm.SomeFool.K Worm.SomeFool.L Worm.SomeFool.M Worm.SomeFool.Gen-unp Worm.SomeFool.O Worm.SomeFool.P Worm.SomeFool.P-dll Worm.SomeFool.Q Worm.SomeFool.N Worm.SomeFool.R Worm.SomeFool.Q.2 So Jeff was right. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Sun Apr 11 02:23:42 CEST 2004 pgp0.pgp Description: PGP signature
Re: [Clamav-users] sendmail
On Sun, 11 Apr 2004 07:54:54 +0800 "Spades" <[EMAIL PROTECTED]> wrote: > any idea, how can i get clam to work with sendmail? I have no ideas. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Sun Apr 11 02:22:46 CEST 2004 pgp0.pgp Description: PGP signature
Re: [Clamav-users] sendmail
On Sunday 11 April 2004 12:54 am, Spades wrote: > any idea, how can i get clam to work with sendmail? http://www.MailScanner.info is good, alternatively there is the clamav-milter, or I believe you can use Amavis. Regards, Antony. -- Wanted: telepath. You know where to apply. Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Netsky P not being blocked, using 0.70-rc
On Apr 10, 2004, at 9:27 AM, Colin A. Bartlett wrote: Jeff Ramsey Sent: Friday, April 09, 2004 4:23 PM I have done some further testing, and I am blocking Somefool and Somefool.B, but I am not blocking variant P. FWIW, this same thing happened to me when I upgraded from Clam .60 to the latest version. Apparently I installed it in a different place so there were two version of my daily updates and it wasn't using the new one. Are you sure your virus signatures are being updated and include the SomeFool.P variant? Run "sigtool --list | grep SomeFool" to see if it's listed. cheers, Colin I ran the command above, and here are the results: Worm.Somefool Worm.Somefool.B Worm.Somefool.B.2 Worm.Somefool.D Worm.Somefool.E Worm.Somefool.F These ones are all working. How can I get freshclam to get the P variant file? Thanks, Jeff --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] sendmail
any idea, how can i get clam to work with sendmail? --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Violation of the GPL ?
On Fri, 09 Apr 2004 14:15:47 +0200 Krištof Petr <[EMAIL PROTECTED]> wrote: > What about replacing Kurt's virus signatures by your own and release > virus database under licence you like? > This will make situation clear. But why ? The GPL is just fine. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Sat Apr 10 18:36:30 CEST 2004 pgp0.pgp Description: PGP signature
RE: [Clamav-users] Netsky P not being blocked, using 0.70-rc
Jeff Ramsey Sent: Friday, April 09, 2004 4:23 PM > I have done some further testing, and I am blocking Somefool and > Somefool.B, but I am not blocking variant P. FWIW, this same thing happened to me when I upgraded from Clam .60 to the latest version. Apparently I installed it in a different place so there were two version of my daily updates and it wasn't using the new one. Are you sure your virus signatures are being updated and include the SomeFool.P variant? Run "sigtool --list | grep SomeFool" to see if it's listed. cheers, Colin Colin A. Bartlett Kinetic Web Solutions www.kineticweb.biz --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
