[Clamav-users] ClamAV Hangs everytime it updates the database
Hi, Everytime freshclam loads a new file from the database into daily.cvd my clamav crashes with message: Apr 15 02:17:19 imaggina X-Qmail-Scanner-1.21: [imaggina108198823347025851] clamscan: corrupt or unknown ClamAV scanner error or memory/resource/perms problem - exit status 50 I have already increase softlimit. But the result is the same, I see this happens everytime the daily database is updated. Does anybody know how can I fix this? Regards, Jorge --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] My installation of ClamAV doesn't detect zipped virus
> If you do not have the same, then either freshclam is not working correctly > (or not running at all) or freshclam is downloading the virus database to > one location and clamav is looking for it in another location. I have seen > this problem more and more lately on this list. Thank you for your response. It turned out I was being impatient. I had downloaded recent virus definitions with freshclam, but clamd hadn't selfchecked the virus database. After 3600 seconds, it detected the database modification and caught Worm.SomeFool.P correctly. Reload clamd after running freshclam. B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
If we had two lists then the subscribers to the standard clamav list would see far fewer (note: not zero, I grant you) postings about milter, because even if the question gets cross-posted, I would like to think that responders will reply to the appropriate list and not the inappropriate one. That's what I meant by the situation being improved. It won't be perfect, but it'll be better. I do see your point. the moment with all the questions going to one list. My opinion is that cross-posting would not be a noticeable problem. (And if you don't like it, there's a simple procmail solution - see below.) I know how to fix it with procmail :) but if a question has been answered on another list then whoever wants to give an answer might not know that the question has been answered on the other list.. If everyone subscribes to two lists then there's no point splitting :) As long as ppl aren't flamed for asking a question on the wrong list... have it split up and see what happens.. B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
> Well, I have a 146k and a 153k email with .exe attachments with virii included > and it never checked them. Matter of fact its not checking any email that > comes into this box for anyone but everything is up and working so I wonder > where the problem is at. I bet its the link between between SM and Clam > since SM works, and Clam works but they just are not talking to one another. > I am so close but this is my first milter (the reason I did not know I > had to recompile until I saw the warning in the logs...which is now gone > after the rebuild). All fixed and it took me two days but I finally found out it was 2 major problems and some little inconsistencies. #1)I needed to grab the source rpm and rebuild it #2)I needed to fix some weird error in the .mc (found the proper lines were in the .mc but they refused to compile into the .cf) As soon as it was fixed and I reloaded sendmail it found 6-7 Gibe.f (whatever that is) so must work. :) Thanks all that tried to help.
Re: [Clamav-users] clamav and milter - dedicated mailing list.
> - cross posting > - questions send to the wrong list > >>> > >>> I think both of these examples are things which would be improved by > >>> having two lists. > > Good idea. While you are at it, create additional lists so that the > issues that are with Linux, PCs SpamAssassin, etc. are not in this list > either as they are a waste of my time. I only want FreeBSD, clamd, and > clamav-milter in this list. Yep, good idea so that people can see who needs what help easier and will actually help themlike me and this milter nightmare.
Re: [Clamav-users] clamd is not scanning my email.
On Wed, 2004-04-14 at 10:21, [EMAIL PROTECTED] wrote: > WOOHOO, or so I thought because when I do cat ./test/test1 | mail root -s "Testing" > I get the one line and nothing has been flagged and nothing in the header has > changed. ps auxwww | grep "clamav-milter" | grep -v grep This will show us the commandline that you're calling clamav-milter with. Chances are you need to add the -l option. Here's what mine looks like: [EMAIL PROTECTED] root]# ps auxwww | grep "clamav-milter" | grep -v grep clamav 15832 0.0 0.0 191696 1248 ? S09:40 0:20 clamav-milter --onfig-file=/etc/clamav.conf --max-children=20 --quiet -ol local:/var/clamav/clmilter.socket If you want to adjust those options, typically it's set in an environment variable in /etc/rc.d/init.d/clamav-milter, but only if it's not previously set in /etc/sysconfig/clamav-milter. Here's my /etc/sysconfig/clamav-milter: [EMAIL PROTECTED] root]# cat /etc/sysconfig/clamav-milter ### Simple config file for clamav-milter, you should ### read the documentation and tweak it as you wish. # # No longer used, 3000 emails a day is a bit much for my blood # [EMAIL PROTECTED] # --postmaster-only CLAMAV_FLAGS=" --config-file=/etc/clamav.conf --max-children=20 --quiet -ol local:/var/clamav/clmilter.socket " Note the lone double-quote on the last line. It's legitimate to set environment variables this way because the carriage returns are stripped when stored in an environment variable (as per the ps command above). Blue skies... Todd --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Source RPM for ClamAV-0.70-rc anyone?
Michael St. Laurent wrote: Does anyone know where a Source RPM for ClamAV-0.70-rc might be found? There's one here: ftp://ftp.neocat.org/pub/SRPMS/clamav-0.70-3mdk.src.rpm -Bill --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
On Apr 14, 2004, at 12:00, Antony Stone wrote: On Wednesday 14 April 2004 7:28 pm, B. van Ouwerkerk wrote: - cross posting - questions send to the wrong list I think both of these examples are things which would be improved by having two lists. Good idea. While you are at it, create additional lists so that the issues that are with Linux, PCs SpamAssassin, etc. are not in this list either as they are a waste of my time. I only want FreeBSD, clamd, and clamav-milter in this list. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] FW: Source RPM for ClamAV-0.70-rc anyone?
Michael St. Laurent <> wrote: > Does anyone know where a Source RPM for ClamAV-0.70-rc might be found? Never mind, I managed to roll my own. ;-D -- Michael St. Laurent Hartwell Corporation --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
Yes. It's not being properly mime encoded. try attaching ./test/test1 to an email from within your MUA (mutt, whatever), and sending that. Also, the milter has to be set up to scan local mail. Well, I have a 146k and a 153k email with .exe attachments with virii included and it never checked them. Matter of fact its not checking any email that comes into this box for anyone but everything is up and working so I wonder where the problem is at. I bet its the link between between SM and Clam since SM works, and Clam works but they just are not talking to one another. I am so close but this is my first milter (the reason I did not know I had to recompile until I saw the warning in the logs...which is now gone after the rebuild).
[Clamav-users] Source RPM for ClamAV-0.70-rc anyone?
Does anyone know where a Source RPM for ClamAV-0.70-rc might be found? -- Michael St. Laurent Hartwell Corporation --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] My installation of ClamAV doesn't detect zipped virus
El mié, 14-04-2004 a las 14:44, Jim Maul escribió: > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Oscar A. > > Valdez > > Sent: Wednesday, April 14, 2004 3:09 PM > > To: [EMAIL PROTECTED] > > Subject: [Clamav-users] My installation of ClamAV doesn't detect zipped > > virus > > > > > > I just installed ClamAV, but Worm.SomeFool.P (in a zip file) is getting > > through, although the online scanner at > > http://www.gietl.com/test-clamav/ detects it. > > > > Am I missing something in my configuration? > > -- > > Oscar A. Valdez > > > > > > most likely you have out of date virus definitions. > > Try: > > sigtool -l |grep SomeFool > > This is my output: > > [EMAIL PROTECTED] elih.org]# sigtool -l|grep SomeFool > Worm.SomeFool.Gen-unp > Worm.SomeFool.O > Worm.SomeFool.P > Worm.SomeFool.P-dll > Worm.SomeFool.Q > Worm.SomeFool.N > Worm.SomeFool.R > Worm.SomeFool.Q.2 > Worm.SomeFool > Worm.SomeFool.B > Worm.SomeFool.B.2 > Worm.SomeFool.D > Worm.SomeFool.E > Worm.SomeFool.F > Worm.SomeFool.Gen-1 > Worm.SomeFool.Gen-2 > Worm.SomeFool.I > Worm.SomeFool.K > Worm.SomeFool.L > Worm.SomeFool.M > > > If you do not have the same, then either freshclam is not working correctly > (or not running at all) or freshclam is downloading the virus database to > one location and clamav is looking for it in another location. I have seen > this problem more and more lately on this list. Thank you for your response. It turned out I was being impatient. I had downloaded recent virus definitions with freshclam, but clamd hadn't selfchecked the virus database. After 3600 seconds, it detected the database modification and caught Worm.SomeFool.P correctly. Thanks again. -- Oscar A. Valdez --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] My installation of ClamAV doesn't detect zipped virus
On Wednesday 14 April 2004 8:08 pm, Oscar A. Valdez wrote: > I just installed ClamAV, but Worm.SomeFool.P (in a zip file) is getting > through, although the online scanner at > http://www.gietl.com/test-clamav/ detects it. > > Am I missing something in my configuration? Try sending yourself an email containing the Eicar Anti-Virus Test String (try both raw and zipped versions in different emails) and see if they get detected. http://www.eicar.org/anti_virus_test_file.htm If both do, the problem is that your ClamAV signatures aren't up to date. (Run freshclam) If the raw one gets picked up and the zipped one goes through, there's something wrong with the way your mail software and ClamAV are handling files. Give us more details about how you're trying to do this. If neither gets picked up, then just try a plain clamscan on a file containing Eicar - something's badly wrong with either your ClamAV installation or the configuration of how emails are supposed to get scanned by it. Regards, Antony. -- In science, one tries to tell people in such a way as to be understood by everyone something that no-one ever knew before. In poetry, it is the exact opposite. - Paul Dirac Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] My installation of ClamAV doesn't detect zipped virus
At 13:08 14-04-2004 -0600, you wrote: I just installed ClamAV, but Worm.SomeFool.P (in a zip file) is getting through, although the online scanner at http://www.gietl.com/test-clamav/ detects it. Am I missing something in my configuration? If you are using milter, is it really running and is Sendmail using it. You have run freshclam.. and updated the database.. have you? You have verified that clamscan can find viri have you? B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] pass mails with virus to spec. acount
On Wednesday 14 Apr 2004 5:48 pm, Sergey Smirnov wrote: > I use sendmail,clamd and clamav-milter. > 1.Is it possible to pass mails with virus to special acount? Yes. man 8 clamav-milter will tell you how. > 2. How can I change default message about virus in mail? At the moment it's hard coded in the source, but not difficult to find or change, once 0.70 has been released I hope to change that. > Thanks. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] My installation of ClamAV doesn't detect zipped virus
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Oscar A. > Valdez > Sent: Wednesday, April 14, 2004 3:09 PM > To: [EMAIL PROTECTED] > Subject: [Clamav-users] My installation of ClamAV doesn't detect zipped > virus > > > I just installed ClamAV, but Worm.SomeFool.P (in a zip file) is getting > through, although the online scanner at > http://www.gietl.com/test-clamav/ detects it. > > Am I missing something in my configuration? > -- > Oscar A. Valdez > > most likely you have out of date virus definitions. Try: sigtool -l |grep SomeFool This is my output: [EMAIL PROTECTED] elih.org]# sigtool -l|grep SomeFool Worm.SomeFool.Gen-unp Worm.SomeFool.O Worm.SomeFool.P Worm.SomeFool.P-dll Worm.SomeFool.Q Worm.SomeFool.N Worm.SomeFool.R Worm.SomeFool.Q.2 Worm.SomeFool Worm.SomeFool.B Worm.SomeFool.B.2 Worm.SomeFool.D Worm.SomeFool.E Worm.SomeFool.F Worm.SomeFool.Gen-1 Worm.SomeFool.Gen-2 Worm.SomeFool.I Worm.SomeFool.K Worm.SomeFool.L Worm.SomeFool.M If you do not have the same, then either freshclam is not working correctly (or not running at all) or freshclam is downloading the virus database to one location and clamav is looking for it in another location. I have seen this problem more and more lately on this list. Jim --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] pass mails with virus to spec. acount
At 20:48 14-04-2004 +0400, you wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I use sendmail,clamd and clamav-milter. 1.Is it possible to pass mails with virus to special acount? man clamav-milter :) -Q, --quarantine=EMAILADDRESS If this e-mail address is given, messages containing a virus or worm are redirected to it. 2. How can I change default message about virus in mail? Around line 2136 of clamav-milter.c but I might be wrong as I don't intend innocent ppl to be bothered by warnings. B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] My installation of ClamAV doesn't detect zipped virus
I just installed ClamAV, but Worm.SomeFool.P (in a zip file) is getting through, although the online scanner at http://www.gietl.com/test-clamav/ detects it. Am I missing something in my configuration? -- Oscar A. Valdez --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
On Wed, Apr 14, 2004 at 12:21:06PM -0500, [EMAIL PROTECTED] said: > Alright, I grabbed the CVS, I rebuilt sendmail via source rpm for the > milter support (DOH not built in the exectuable rpm from RH) and I > have everything running with all processes running and the sendmail > milter lines in the mc. > > So far so good and even a surprise when I scan my maillog and see > > clamav-milter[2747]: clamd / ClamAV version devel-20040414, > clamav-milter version 0.70i > > WOOHOO, or so I thought because when I do cat ./test/test1 | mail root > -s "Testing" I get the one line and nothing has been flagged and > nothing in the header has changed. > > Any ideas? Yes. It's not being properly mime encoded. try attaching ./test/test1 to an email from within your MUA (mutt, whatever), and sending that. Also, the milter has to be set up to scan local mail. -- -- | Stephen Gran | Custer committed Siouxicide.| | [EMAIL PROTECTED] | | | http://www.lobefin.net/~steve | | -- pgp0.pgp Description: PGP signature
Re: [Clamav-users] clamav and milter - dedicated mailing list.
On Wednesday 14 April 2004 7:28 pm, B. van Ouwerkerk wrote: > > > - cross posting > > > - questions send to the wrong list > > > > I think both of these examples are things which would be improved by > > having two lists. > > Of course not. Do we have cross postings right now? No. Not literally cross-posted, of course not, but everyone subscribed to this list sees all the questions about clamav-milter, whether that topic interests them or not. If we had two lists then the subscribers to the standard clamav list would see far fewer (note: not zero, I grant you) postings about milter, because even if the question gets cross-posted, I would like to think that responders will reply to the appropriate list and not the inappropriate one. That's what I meant by the situation being improved. It won't be perfect, but it'll be better. > It's not realistic to assume that most newcomers will understand the > difference, that's why I'm afraid that most ppl will cross-post just the > same because that will provide the fastest way to get an answer. I disagree. I think the purpose and focus of the two lists can be perfectly well explained on the page inviting people to subscribe to them, and as I said before, even if people do cross-post, that's no worse than we have at the moment with all the questions going to one list. My opinion is that cross-posting would not be a noticeable problem. (And if you don't like it, there's a simple procmail solution - see below.) > Taking this one step further you could assume to have dedicated lists for > about every special interest group that has something talking to clamd. No, I agree with Odhiambo's assertion that the milter is a special case in this instance, because it's a big enough interest group of its own, it has its own software development and version numbers, and the problems people encounter with it are generally quite independent of problems with the main ClamAV software. > The few who are really bothered to much could operate the DEL key or use > procmail to filter it out of their life. Procmail is much easier if the message headers say it's been cross-posted, so if that's what you're worried about, there's a solution right there. Deleting unwanted emails is not as elegant a solution as not subscribing to the list you're not interested in. Regards, Antony. -- Perfection in design is achieved not when there is nothing left to add, but rather when there is nothing left to take away. - Antoine de Saint-Exupery Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
> I have seen lists split up in the past.. like the PHP lists. The results of > this: > - cross posting > - questions send to the wrong list I think both of these examples are things which would be improved by having two lists. Ofcourse not. Do we have cross postings right now? No. At the moment it's as though we do have two lists, except they're not separated, so for many people questions about milters are already being sent to the wrong list in effect, and cross-posting should only occur in the case of "I have this problem and it might be the milter or it might not", which again we are seeing already, and the number of such messages which any subscriber to only the "non-milter" list would see in future will be less. It's not realistic to assume that most newcomers will understand the difference, that's why I'm afraid that most ppl will cross-post just the same because that will provide the fastest way to get an answer. Look at it from their point of view: they have a problem and want it solved now. I have seen this kind of discussion on multiple lists and it's just a bad idea. All lists which were splitted have cross postings. Taking this one step further you could assume to have dedicated lists for about every special interest group that has something talking to clamd. The risk of knowledge and experience not being at one place, not to mention cross posting is just to big. The few who are really bothered to much could operate the DEL key or use procmail to filter it out of their life. B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] virus names (any reference?)
Quoting jef moskot <[EMAIL PROTECTED]>: I think a concern with image is legitimate. Calling a well-known worm something else for no immediately obvious purpose (yes, it makes sense How many times must we endure this incorrect statement? when you explain it to someone, but most users wouldn't get that on their own) makes the product seem a little dicey. It might make admins ask, "Should I put nonconformist software on my production server?" That isn't the right question. The real question is: "Should I put this non-release pre-version-one still-under-development software on my *production server*?" And you think they are going to worry about the name of one virus, rather than the fact that the software hasn't even reached version 1.0 yet? If so, don't hire them. If you're going to decide on running pre-1.0 software you are going to have to put some time into investigating it, and if you put any time into investigating or testing ClamAV you will find out it the netsky issue and how to solve it. Come on, let's be real here. A central repository of cross-references would probably be the best and most resilient solution. I definitely agree, but that's a lot of work. Not really. But there are other issues (machine/hardware to run it on, bandwidth to support it, etc). But if you are going to complain about some missing feature in an open source project, you better be willing to step up and help provide the feature! I know I keep saying the same thing here (and I'll stop now, if nothing new is brought up), but this seems like a real no-brainer to me. It might be different if we weren't constantly getting questions on this list the whoel SomeFool/Netsky issue. I just don't understand why we're insisting on going against the grain on this one... Are you sure he's going against the grain, and not you? Sorry to go on about this so much, because it really is a minor point, but it seems like we're being a little silly with this one. Jeffrey Moskot System Administrator [EMAIL PROTECTED] -- Eric Rostetter --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
Alright, I grabbed the CVS, I rebuilt sendmail via source rpm for the milter support (DOH not built in the exectuable rpm from RH) and I have everything running with all processes running and the sendmail milter lines in the mc. So far so good and even a surprise when I scan my maillog and see clamav-milter[2747]: clamd / ClamAV version devel-20040414, clamav-milter version 0.70i WOOHOO, or so I thought because when I do cat ./test/test1 | mail root -s "Testing" I get the one line and nothing has been flagged and nothing in the header has changed. Any ideas? Thanks all for trying to help as I am very close now to it working.
[Clamav-users] pass mails with virus to spec. acount
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I use sendmail,clamd and clamav-milter. 1.Is it possible to pass mails with virus to special acount? 2. How can I change default message about virus in mail? Thanks. - -- Sergey Smirnov hkp://wwwkeys.pgp.net -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFAfWtpTW1qobfmhlsRAtXFAKCgVYMl/6o4O+n2G0XnYBJeGl9ZqwCgh7GP p0FhXo/E/pM9xFu5q95plks= =gJnF -END PGP SIGNATURE- --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] virus names (any reference?)
B. van Ouwerkerk wrote: I partially disagree. It would be possible to fill a database with the announcements on the virusdb list without user intervention.. procmail and PHP is a nice combination but Perl or python would be fine too. If you look at old and new updates and submitted by different people you will see that they differ in format which makes it hard to parse. That problem is being addressed now. All it would take are a few users who keep an eye on the database and enter additional information if they have it. That's the plan. -- /Peter Bonivart --Unix lovers do it in the Sun Sun Fire V210, Solaris 9, Sendmail 8.12.10, MailScanner 4.29.7, SpamAssassin 2.63 + DCC 1.2.39, ClamAV 0.70RC + GMP 4.1.2, MailStats 0.25 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd.ctl not read at bootup
On Tue, 2004-04-13 at 08:34, Karl Hakmiller wrote: > It looks as if I'll have to do as you suggest -- just give up on clamav-milter -- > but before I do, I'll spend a few more days > hacking at it. I did come across the information in the user > manual for the 0.70 release of ClamAV that clamav-milter should This is the version that I'm using that has been rock solid (whereas the 0.70 rc release would crash within a few hours) clamd / ClamAV version devel-20040401, clamav-milter version 0.70d I took this CVS snapshot sometime on April Fools Day and this has been the most stable clamav I've ever used. I'm not trying anything new until some new commits to CVS get ironed out. Blue skies... Todd --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav-milter compile issue
On Wednesday 14 Apr 2004 4:32 pm, Pad Hosmane wrote: > Nigel, >I am not a programmer. With trial and error I figured out how to > compile clamav-milter.c. Please guide me how to use inet_ntoa() instead > of inet_ntop()? Try this: remoteIP = inet_ntoa(((struct sockaddr_in *)(hostaddr))->sin_addr); -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
On Wed, 14 Apr 2004 17:01:15 +0300, Odhiambo Washington <[EMAIL PROTECTED]> wrote: >May I propose a separate mailing list for milter users? There seems to >be alot of discussions about milter (now I even know it's some form of >sendmail plugin) that warrants this. >Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) >The list could be named clamav-milter-users. >I believe the usage of ClamAv has grown to an extent that this now >warranted. > > I'm against it. Often, the issue is the interaction with clamd and the milter. Even if you're not using the milter, there might be something to be learned about clamd or something you can contribute. The volume of messages is not so great as to make it difficult to mentally filter out messages that you don't have time to read. In addition, it will lead to the inevitable "take it to the other list" threads, that tend to result in the sort of negativity that makes some other mailing lists less useful. (FWIW, I use Agent to read the list. It lets me treat the list like a newsgroup, and like any newsgroup there are degrees of relevance for any message with what interests me today.) -- Steve --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
On Wednesday 14 April 2004 4:21 pm, B. van Ouwerkerk wrote: > At 17:01 14-04-2004 +0300, you wrote: > >May I propose a separate mailing list for milter users? There seems to > >be alot of discussions about milter (now I even know it's some form of > >sendmail plugin) that warrants this. > >Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) > >The list could be named clamav-milter-users. > >I believe the usage of ClamAv has grown to an extent that this now > >warranted. > > I have seen lists split up in the past.. like the PHP lists. The results of > this: > - cross posting > - questions send to the wrong list I think both of these examples are things which would be improved by having two lists. At the moment it's as though we do have two lists, except they're not separated, so for many people questions about milters are already being sent to the wrong list in effect, and cross-posting should only occur in the case of "I have this problem and it might be the milter or it might not", which again we are seeing already, and the number of such messages which any subscriber to only the "non-milter" list would see in future will be less. Regards, Antony. -- These clients are often infected by viruses or other malware and need to be fixed. If not, the user at that client needs to be fixed... - Henrik Nordstrom, on Squid users' mailing list Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] clamav-milter compile issue
> On HP-UX 11.00 routine inet_ntop is not available; it's available only > on HP-UX 11i. Compilation was success if I comment the line in > clamav-milter.c > > remoteIP = (char *)inet_ntop(AF_INET, &((struct sockaddr_in > *)(hostaddr))->sin_addr, ip, sizeof(ip)); On systems without inet_ntop() I would suggest using inet_ntoa() > PAd -Nigel Nigel, I am not a programmer. With trial and error I figured out how to compile clamav-milter.c. Please guide me how to use inet_ntoa() instead of inet_ntop()? Commenting the line below line in clamav-milter was enough? remoteIP = (char *)inet_ntop(AF_INET, &((struct sockaddr_in *)(hostaddr))->sin_addr, ip, sizeof(ip)); Thanks PAd --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
At 17:01 14-04-2004 +0300, you wrote: May I propose a separate mailing list for milter users? There seems to be alot of discussions about milter (now I even know it's some form of sendmail plugin) that warrants this. Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) The list could be named clamav-milter-users. I believe the usage of ClamAv has grown to an extent that this now warranted. I have seen lists split up in the past.. like the PHP lists. The results of this: - cross posting - questions send to the wrong list It's good to see that ppl are learning while on this list :-) B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] clamav and milter - dedicated mailing list.
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Antony > Stone > Sent: Wednesday, April 14, 2004 10:18 AM > To: [EMAIL PROTECTED] > Subject: Re: [Clamav-users] clamav and milter - dedicated mailing list. > > > On Wednesday 14 April 2004 3:01 pm, Odhiambo Washington wrote: > > > May I propose a separate mailing list for milter users? There seems to > > be alot of discussions about milter (now I even know it's some form of > > sendmail plugin) that warrants this. > > Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) > > The list could be named clamav-milter-users. > > I believe the usage of ClamAv has grown to an extent that this now > > warranted. > > > > Any seconders > > Yes, I second this proposal - it should also help to add a clue > to some of the > posting we get, where people say "my ClamAV isn't catching viruses in my > email", and they don't tell us how they've connected the two systems > together. At least with a milter list we can assume that part in any > posting. > > I'm all for segregating off items which are likely to be of > interest to only a > sub-group of the subscribers to the main ClamAV list, too. > > Regards, > > Antony. > I'll second the second on this one. I use qmail with qmail-scanner and all this milter talk is quite strange to me. I am not interested in it nor can i be of ANY help with it. Jim --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] virus names (any reference?)
> A central repository of cross-references would probably be the best and > most resilient solution. I definitely agree, but that's a lot of work. I partially disagree. It would be possible to fill a database with the announcements on the virusdb list without user intervention.. procmail and PHP is a nice combination but Perl or python would be fine too. All it would take are a few users who keep an eye on the database and enter additional information if they have it. I have a few thoughts about this but since someone else is already building a solution I'd rather wait and see what comes out. No fun in doubling someone elses work. I know I keep saying the same thing here (and I'll stop now, if nothing new is brought up), but this seems like a real no-brainer to me. It might be different if we weren't constantly getting questions on this list the whoel SomeFool/Netsky issue. This will probably happen with each new and famous virus too. I just don't understand why we're insisting on going against the grain on this one... As long as there is no agreement in the AV industry it's an illusion that all AV software will give a virus the same name. B. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav-milter compile issue
> On HP-UX 11.00 routine inet_ntop is not available; it's available only > on HP-UX 11i. Compilation was success if I comment the line in > clamav-milter.c > > remoteIP = (char *)inet_ntop(AF_INET, &((struct sockaddr_in > *)(hostaddr))->sin_addr, ip, sizeof(ip)); On systems without inet_ntop() I would suggest using inet_ntoa() > PAd -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] clamav and milter - dedicated mailing list.
Sounds good -Original Message- From: Antony Stone [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 14, 2004 10:18 AM To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] clamav and milter - dedicated mailing list. On Wednesday 14 April 2004 3:01 pm, Odhiambo Washington wrote: > May I propose a separate mailing list for milter users? There seems to > be alot of discussions about milter (now I even know it's some form of > sendmail plugin) that warrants this. Some of us use Exiscan and we > find milter quite a 'strange' idea ;-)) The list could be named > clamav-milter-users. I believe the usage of ClamAv has grown to an > extent that this now warranted. > > Any seconders Yes, I second this proposal - it should also help to add a clue to some of the posting we get, where people say "my ClamAV isn't catching viruses in my email", and they don't tell us how they've connected the two systems together. At least with a milter list we can assume that part in any posting. I'm all for segregating off items which are likely to be of interest to only a sub-group of the subscribers to the main ClamAV list, too. Regards, Antony. -- The first fifty percent of an engineering project takes ninety percent of the time, and the remaining fifty percent takes another ninety percent of the time. Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Eicar test
On Wed, 2004-04-14 at 04:15, Mike van Vugt wrote: > Hi, > > Downloaded the test but my provider does not allow me to send that > file... I get back a mail telling me the virus is removed and that i am > not allowd to send virusses ;-))) That's a good thing that your provider is providing virus scanning. You may want to ask them what they use for virus scanning. If they run clamav, then you don't need to bother running it on your home system unless you're operating your own mail server. It's good that you got clamd running, but in your situation I'm not sure what value it is. Clamd in and of itself will not scan and delete infected email. You need to have another program that feeds messages to clamd, then checks the status and either passes the mail on for delivery or deletes it. This is most often used on mail server machines. In the case where you collect your mail via POP or IMAP from an ISP with your mail client (e.g., evolution), you probably want to run the command line version of the scanner (clamscan) as a filter rule in evolution on your incoming mail. I think this has been discussed on the mailing list in the past, so check the archives for examples of how to configure evolution to do this. -Bill --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav and milter - dedicated mailing list.
On Wednesday 14 April 2004 3:01 pm, Odhiambo Washington wrote: > May I propose a separate mailing list for milter users? There seems to > be alot of discussions about milter (now I even know it's some form of > sendmail plugin) that warrants this. > Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) > The list could be named clamav-milter-users. > I believe the usage of ClamAv has grown to an extent that this now > warranted. > > Any seconders Yes, I second this proposal - it should also help to add a clue to some of the posting we get, where people say "my ClamAV isn't catching viruses in my email", and they don't tell us how they've connected the two systems together. At least with a milter list we can assume that part in any posting. I'm all for segregating off items which are likely to be of interest to only a sub-group of the subscribers to the main ClamAV list, too. Regards, Antony. -- The first fifty percent of an engineering project takes ninety percent of the time, and the remaining fifty percent takes another ninety percent of the time. Please reply to the list; please don't CC me. --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] clamav and milter - dedicated mailing list.
May I propose a separate mailing list for milter users? There seems to be alot of discussions about milter (now I even know it's some form of sendmail plugin) that warrants this. Some of us use Exiscan and we find milter quite a 'strange' idea ;-)) The list could be named clamav-milter-users. I believe the usage of ClamAv has grown to an extent that this now warranted. Any seconders cheers - wash +--+-+ Odhiambo Washington . WANANCHI ONLINE LTD (Nairobi, KE) | . 1ere Etage, Loita Hse, Loita St., | GSM: (+254) 722 743 223 . # 10286, 00100 NAIROBI | GSM: (+254) 733 744 121 . (+254) 020 313 985 - 9 | +-+--+ "Oh My God! They killed init! You Bastards!" --from a /. post --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
Nigel Horne <[EMAIL PROTECTED]> wrote .. > Your best bet is to download the latest source from CVS, run > 'rpm -ev clamav (or whatever the clam RPMs are called that you have) > configure --enable-milter --enable-cache > make > make install' > and follow > the documentation in .../clamav-devel/clamav-milter/INSTALL. > > There is one dependancy - you must have the sendmail-devel RPM > installed. You should be up and and running in 5 minutes, honest, provided > you have followed the instructions to the letter. > > > Thanks. > > -Nigel Yeah, I always try tarballs first because I prefer them to rpm's but in this case you are probably right.
[Clamav-users] More clamav-milter child process issues
On Fri, 9 Apr 2004, I wrote: > I have been running ClamAV version devel-20040405 for three days without > issue, until this morning. Actually, clamav-milter had been running for about 28 hours before the start of the errors. > Now, for each virus rejected, the following > entry appears in the syslog: > > /kernel: pid 72343 (clamav-milter), uid 3001: exited on signal 11 > > These appear to be from children as the parent proccess continues to > run. All else appears normal. > > System info: > FreeBSD 4.9-RELEASE-p2 > clamd / ClamAV version devel-20040405 > ClamAV version devel-20040405, clamav-milter version 0.70g > > # ps ax | grep clam > 17139 ?? Is 0:00.07 /usr/local/bin/freshclam -d -c 13 > 40560 ?? Ss 2:41.65 /usr/local/sbin/clamd > 40568 ?? Ss 0:13.25 /usr/local/sbin/clamav-milter -lonHP -m50 This has happened again. After nearly four days of error free operation, clamav-milter children that find a virus exit sig 11. Also, I found one clamav-milter child stuck consuming 100% CPU. Please note: - Some amount of time passes from the start of the clamav-milter parent process before problems with child processes begin. - ONLY clamav-milter children that report a virus exit sig 11 (or consume 100% cpu). - clamav-milter children that DO NOT report a virus exit cleanly. - Both clamd.log and maillog look normal. Only syslog has errors. These are milters reporting a virus... Apr 13 10:03:12 copland /kernel: pid 33341 (clamav-milter), uid 3001: exited on signal 11 Apr 13 10:03:26 copland /kernel: pid 33353 (clamav-milter), uid 3001: exited on signal 11 Apr 13 10:24:49 copland /kernel: pid 33750 (clamav-milter), uid 3001: exited on signal 11 Apr 13 10:24:51 copland /kernel: pid 33752 (clamav-milter), uid 3001: exited on signal 11 Apr 13 10:24:53 copland /kernel: pid 33754 (clamav-milter), uid 3001: exited on signal 11 Apr 13 11:05:23 copland /kernel: pid 34395 (clamav-milter), uid 3001: exited on signal 11 Apr 13 11:05:34 copland /kernel: pid 34400 (clamav-milter), uid 3001: exited on signal 11 Apr 13 11:05:45 copland /kernel: pid 34407 (clamav-milter), uid 3001: exited on signal 11 What would the developers require of me in order to help narrow down this problem? -- Michael Lambert Systems Admin, IT Dept JEOL USA Inc http://www.jeol.com --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] clamav-milter compile issue
Hi, I had the same problem but only for INET_ADDRSTRLEN not being defined... The first thing I would look for is to see if you have the library /usr/local/include/netinet/in.h To be on the safe side, because some progs look in /usr/local/include and others in /usr/include, make sure you have all librarys in both places i.e. both places have the same files. In my case the library did not define the parametre INET_ADDRSTRLEN so I edited the clamav-milter.c and added: #ifndef INET_ADDRESTRLEN #define INET_ADDRESTRLEN 16 #endif just after the big list on #include 's Hope it helps, Nikos Karamanolis Systems Support Engineer Ideal Systems Hi, Thanks for the reply. I inserted the values you said in clamav-milter.c, now I am getting the following error /bin/sh ../libtool --mode=link gcc -g -O2 -L/usr/local/lib -L/opt/gmp/lib -L/usr/lib -o clamav-milter clamav-milter.o ../clamd/cfgfile.o ../clamd/others.o ../clamscan/getopt.o -L../libclamav -lclamav -L/usr/lib/libmilter -lmilter -lpthread gcc -g -O2 -o clamav-milter clamav-milter.o ../clamd/cfgfile.o ../clamd/others.o ../clamscan/getopt.o -L/usr/local/lib -L/opt/gmp/lib -L/usr/lib -L/test/down/clamav-0.70-rc/libclamav /usr/local/clamav70/lib/libclamav.sl -lz -L/usr/lib/libmilter -lmilter -lpthread -Wl,+b -Wl,/usr/local/clamav70/lib /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (/usr/local/lib/libmilter.sl(main.o)) was detected. The linked output may not run on a PA 1.x system. /usr/ccs/bin/ld: Unsatisfied symbols: inet_ntop (first referenced in clamav-milter.o) (code) collect2: ld returned 1 exit status *** Error exit code 1 Stop. On HP-UX 11.00 routine inet_ntop is not available; it’s available only on HP-UX 11i. Compilation was success if I comment the line in clamav-milter.c remoteIP = (char *)inet_ntop(AF_INET, &((struct sockaddr_in *)(hostaddr))->sin_addr, ip, sizeof(ip)); Does it affect any another functionality by commenting the above line in clamav-milter.c? Thanks PAd
Re: [Clamav-users] clamav-milter and libmilter error. Hints?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 14 Apr 2004 13:03, Mr Mailing List wrote: > >> I have installed clamav and clamav-milter on netbsd 1.6 (all > >> However, some infected mails (for example the eicar test) > >> producesout-of-memory errors (see below). It seems that it only > >> happens withinfected files, not clean ones. > > > > Which version (run clamav-milter --version to find out). > > ClamAV version 0.70-rc, clamav-milter version 0.70 Try the latest version from CVS, that is much better at handling memory. > /jørgen nørgaard > e-mail: [EMAIL PROTECTED] | Phone: +45 2627 3769 > http://anneli.dk/~jnp/ - -Nigel - -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFAfTOfhTUd3VwpF6IRAh4kAJ4xukmr+HHKw4yu+sGemUNxQBUbkACggoUb eY/tnK5ECRKquv0/xu/YO88= =AsCQ -END PGP SIGNATURE- --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] virus names (any reference?)
On Wed, 14 Apr 2004, Bart Silverstrim wrote: > On Apr 13, 2004, at 7:16 PM, jef moskot wrote: > > Personally, I don't understand why this particular name has not been > > changed, given the prevalence of this worm. > Statistics being broken, it would create "transient" viruses that in > reality were just renamed, adds to the cruft of multiple names floating > around in lists and search engines, I'm only talking about the seriously ridiculous differently-named worms here. Let's say, for example, one we're all probably receiving (at least) a couple hundred of each day. (I don't even think there's another example in the ClamAV database.) The "broken statistics" argument is the only one I think carries any weight. I personally don't care about this one, and even if I did, it doesn't sound like anything that can't be fixed with a simple search and replace, but I understand how this could be a big deal for some of us. If you want to get rid of "cruft", eliminating "SomeFool" would be a good way to do it. Actually, I think it should have been done a long time ago, once it became obvious that this one's going to be with us for a long time. To me, the only question is: is the continuing confusion worse than the work necessary to change those databases? I don't suppose we actually have the data to answer that question. But, as I said before, if a new user who is considering using ClamAV checks to see if the worm that's currently slamming his server is detected by ClamAV and he does the most reasonable search possible, it's going to look like ClamAV doesn't do the job. If another crappy magazine reviews ClamAV, a hack writer could check the database and write "Ha, it doesn't even catch Netsky!". I think a concern with image is legitimate. Calling a well-known worm something else for no immediately obvious purpose (yes, it makes sense when you explain it to someone, but most users wouldn't get that on their own) makes the product seem a little dicey. It might make admins ask, "Should I put nonconformist software on my production server?" > A central repository of cross-references would probably be the best and > most resilient solution. I definitely agree, but that's a lot of work. I know I keep saying the same thing here (and I'll stop now, if nothing new is brought up), but this seems like a real no-brainer to me. It might be different if we weren't constantly getting questions on this list the whoel SomeFool/Netsky issue. I just don't understand why we're insisting on going against the grain on this one... Sorry to go on about this so much, because it really is a minor point, but it seems like we're being a little silly with this one. Jeffrey Moskot System Administrator [EMAIL PROTECTED] --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav-milter and libmilter error. Hints?
On Apr 14, 2004, at 12:44, Nigel Horne wrote: On Wed, 2004-04-14 at 11:17, Mr Mailing List wrote: Hello, I have installed clamav and clamav-milter on netbsd 1.6 (all packages,include sendmail, libmilter and pth, are current) and it appears towork fine (i.e. catching viruses). However, some infected mails (for example the eicar test) producesout-of-memory errors (see below). It seems that it only happens withinfected files, not clean ones. Which version (run clamav-milter --version to find out). ClamAV version 0.70-rc, clamav-milter version 0.70 Sorry that I forgot to mention that. -- /jørgen nørgaard e-mail: [EMAIL PROTECTED] | Phone: +45 2627 3769 http://anneli.dk/~jnp/ |\ _,,,---,,_ /,`.-'`' -. ;-;;,_ |,4- ) )-,_. ,\ ( `'-' '---''(_/--' `-'\_)
Re: [Clamav-users] virus names (any reference?)
On Apr 13, 2004, at 7:16 PM, jef moskot wrote: On Wed, 14 Apr 2004, Jesper Juhl wrote: I've been working on a website to allow users to do exactely that, but due to being overworked and various other issues it has not progressed as fast as I had hoped - still working on it when I have a chance though, so expect something like that in the future. I think if the website just said "What we call 'SomeFool' others call 'Netsky'," 95% of all questions would be covered. Personally, I don't understand why this particular name has not been changed, given the prevalence of this worm. A comprehensive web site would certainly be a nice feature, but I think it's really overkill while resources are limited. Statistics being broken, it would create "transient" viruses that in reality were just renamed, adds to the cruft of multiple names floating around in lists and search engines, A central repository of cross-references would probably be the best and most resilient solution. I think this is what the "big boys" do in the corporate AV world...you look up the virus in their knowledge bases and it can list the aliases (although I see the quality of their knowledge bases/encyclopedias seem to be rapidly going downhill in the past couple years...) --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] ScanOLE2 - who is using this successfully?
Hello all, For quite sometime, I've had to resist the enabling of this option in clamav.conf because whenever I do, I get the following message: Can't open /var/tmp//da538de874b4bc60/_VBA_PROJECT in the debug info. There is a corresponding msg in clamd.log which is almost similar. Perhaps I've sent that to the list b4? I don't have one now. What is this that I could be missing? cheers - wash +--+-+ Odhiambo Washington . WANANCHI ONLINE LTD (Nairobi, KE) | . 1ere Etage, Loita Hse, Loita St., | GSM: (+254) 722 743 223 . # 10286, 00100 NAIROBI | GSM: (+254) 733 744 121 . (+254) 020 313 985 - 9 | +-+--+ "Oh My God! They killed init! You Bastards!" --from a /. post --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] Eicar test
Hi, Downloaded the test but my provider does not allow me to send that file... I get back a mail telling me the virus is removed and that i am not allowd to send virusses ;-))) Regards, -- - Mike van Vugt - ICQ: 291077353 - - Mail: [EMAIL PROTECTED] - --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamav-milter and libmilter error. Hints?
On Wed, 2004-04-14 at 11:17, Mr Mailing List wrote: > Hello, > > I have installed clamav and clamav-milter on netbsd 1.6 (all > packages,include sendmail, libmilter and pth, are current) and it > appears towork fine (i.e. catching viruses). > > However, some infected mails (for example the eicar test) > producesout-of-memory errors (see below). It seems that it only > happens withinfected files, not clean ones. Which version (run clamav-milter --version to find out). -Nigel --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] clamav-milter and libmilter error. Hints?
Hello, I have installed clamav and clamav-milter on netbsd 1.6 (all packages, include sendmail, libmilter and pth, are current) and it appears to work fine (i.e. catching viruses). However, some infected mails (for example the eicar test) produces out-of-memory errors (see below). It seems that it only happens with infected files, not clean ones. I am looking to ideas of where to look for the problem to be able to remove the error. Is this a symptom that points to one component (sendmail, libmilter, ...)? Mar 30 23:07:22 www sendmail[4015]: i2UL7MvV004015: from=<[EMAIL PROTECTED]>, size=1790, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED]>, proto=ESMTP, daemon=MTA, relay=[192.168.2.200] Mar 30 23:07:22 www sendmail[4015]: i2UL7MvV004015: SYSERR(root): out of memory: Cannot allocate memory Mar 30 23:07:52 www ipop3d[4022]: Login user=jnp host=[192.168.2.200] nmsgs=48/48 -- /jørgen nørgaard e-mail: [EMAIL PROTECTED] | Phone: +45 2627 3769 http://anneli.dk/~jnp/ |\ _,,,---,,_ /,`.-'`' -. ;-;;,_ |,4- ) )-,_. ,\ ( `'-' '---''(_/--' `-'\_)
Re: [Clamav-users] Cleaning MBOX files?
On Wed, 14 Apr 2004, Nigel Horne wrote: > On Wednesday 14 Apr 2004 12:58 am, jef moskot wrote: > > Is keeping a message counter feasible, given the design of the code? > It's perfectly feasable and I've just done it when you enable debug to help > you (look in the CVS code I've just committed - mbox.c version 1.66). This is great news! Thanks very much! Jeffrey Moskot System Administrator [EMAIL PROTECTED] --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Cleaning MBOX files?
On Wednesday 14 Apr 2004 12:58 am, jef moskot wrote: > Is keeping a message counter feasible, given the design of the code? It's perfectly feasable and I've just done it when you enable debug to help you (look in the CVS code I've just committed - mbox.c version 1.66). However please don't enable debug all the time, and remember that enabling debug now also leaves the temporary files around to aid (of course!) debugging. Look for the "Deal with email number %d" messages. > Jeffrey Moskot > System Administrator > [EMAIL PROTECTED] -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd.ctl not read at bootup
On Tuesday 13 Apr 2004 4:34 pm, Karl Hakmiller wrote: > I did come across the information in the user > manual for the 0.70 release of ClamAV that clamav-milter should > be installed in /usr/local/sbin it's not there so maybe the darned > thing just wasn't installed correctly by the rpm I used. clamav-milter can be installed anywhere. The usual place is indeed /usr/local/sbin but it can be anywhere. I suggest that you remove the RPM and download/build from CVS > I'm going to start over from scratch with clamav-milter to see > if that fixes the problem. I suggest that you remove the RPM and download/build from CVS following the install instructions in .../clamav-devel/clamav-milter/INSTALL. -Nigel. -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] Write failure
This is an ongoing issue. Please reach the list archives. Julio Galicia wrote: Hi, list: --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
Re: [Clamav-users] clamd is not scanning my email.
On Tuesday 13 Apr 2004 8:38 pm, [EMAIL PROTECTED] wrote: > I have done everything in the docs and still it just does not work. I am > on RH9 so I had to use the rpm version to even get clamd to work but there > it is in the processes but check the maillog and not one mention of > scanning the test file. Your best bet is to download the latest source from CVS, run 'rpm -ev clamav (or whatever the clam RPMs are called that you have) configure --enable-milter --enable-cache make make install' and follow the documentation in .../clamav-devel/clamav-milter/INSTALL. There is one dependancy - you must have the sendmail-devel RPM installed. You should be up and and running in 5 minutes, honest, provided you have followed the instructions to the letter. > Thanks. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] ClamAV Hangs with an error message
On Tue, 13 Apr 2004 11:04:26 +0200 Jorge Rodríguez <[EMAIL PROTECTED]> wrote: > Hi, > > I think database initialization is OK. I make the upgrade through > freshclam and it seems everythink OK. Why is it working for hours and > then stop? How can I fix the error 50: Database initialization > error.?? Please increase the soflimit value. -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Tue Apr 13 13:19:02 CEST 2004 -Mensaje original- De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] En nombre de Tomasz Kojm Enviado el: martes, 13 de abril de 2004 13:19 Para: [EMAIL PROTECTED] Asunto: Re: [Clamav-users] ClamAV Hangs with an error message I think the way is to use softlimit before initialization of qmail-smtpd. I tried this on my /etc/init.d/qmail file: ulimit -v 8192 sh -c "start-stop-daemon --start --quiet --user qmaild \ --exec /usr/local/bin/softlimit -- -m 200 \ /usr/bin/tcpserver -R -H \ -u `id -u qmaild` -g `id -g nobody` -x /var/vpopmail/etc/tcp.smtp.cdb 0 smtp \ /usr/sbin/qmail-smtpd /var/vpopmail/bin/vchkpw /bin/true 2>&1 \ | $logger -t qmail -p mail.notice &" Is it that ok??? Qmail starts but I receive messages from syslog with problems allocating memory, which is the value for softlimit I have to set up? Thanks a lot, Jorge --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
