Re: [clamav-users] https support for freshclam
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Tue, Dec 30, 2014 at 8:15 AM, Dennis Peterson denni...@inetnw.com wrote: If I were in your position I'd also use rsync as that is what I did when I was in your position (retirement is a fine thing). It also provides a very atomic-like operation so if clamd or clamscan needed to read the signatures they're not in a half-there state. Your case involves protecting intellectual property and that is justification for just about any solution you can come up with. dp On 12/29/14 6:43 AM, Torge Husfeldt wrote: Hi, Am 24.12.2014 um 12:09 schrieb Arnaud Jacques / SecuriteInfo.com: Le mardi 23 décembre 2014, 10:56:37 Dennis Peterson a écrit : Second try: What problem are you trying to solve with https? Privacy. I'd like to expand upon this. For the standard use-case using the official sources this might be irrelevant and actually present more draw-backs than advantages. But: just like the original poster we have a DB of internal signatures and we had to solve the exact same problem. We resolved not to use freshclam at all but rsync/sigUSR1 the updated signatures to our ~20k Servers. ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] (no subject)
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Sun, Dec 28, 2014 at 1:47 AM, jpff j...@codemist.co.uk wrote: Thank you Shawn; that fixes it. I did look at the archive but clearly inadequately All working at company and university ==John ffitch ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Protection from cryptowall/cryptolocker
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Wed, Dec 24, 2014 at 12:38 AM, Steve Basford steveb_cla...@sanesecurity.com wrote: On Tue, December 23, 2014 6:35 pm, Alex Regan wrote: I'd appreciate any further documents or other methods of protection that people are using to block these? ClamAV and Sanesecurity signatures will help block malware which is emailed in, which can then download exploit packs, some of which contain CrytoWall etc. Sanesecurity sigs are here: http://sanesecurity.com/foxhole-databases/ http://sanesecurity.com/usage/signatures/ Sanesecurity blog with current malware being seen... http://sanesecurity.blogspot.co.uk/ You might also want to sort out windows users with group policy type stuff or something like this (Windows): CryptoPrevent: https://www.foolishit.com/vb6-projects/cryptoprevent/technical-information/ These are worth looking at... http://labs.bitdefender.com/2014/12/bitdefender-offers-free-cryptowall-vaccine/ http://www.surfright.nl/en/cryptoguard Cheers, Steve Web: Sanesecurity.com Blog: sanesecurity.blogspot.co.uk ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Regarding Clamav 0.98.5 installation from source code
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Wed, Dec 24, 2014 at 12:25 AM, Dennis Peterson denni...@inetnw.com wrote: What a dummy - I responded to the wrong post :) On 12/23/14 10:41 AM, Dennis Peterson wrote: ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] sigwhitelist.ign2 whitelist not working
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Tue, Dec 9, 2014 at 7:29 PM, polloxx poll...@gmail.com wrote: Thanks Steve, that works. On Tue, Dec 9, 2014 at 2:43 PM, Steve Basford steveb_cla...@sanesecurity.com wrote: On Tue, December 9, 2014 1:33 pm, polloxx wrote: % cat local.ign2 SecuriteInfo.com.Spammer.ec-messenger.com.UNOFFICIAL SecuriteInfo.com.Spammer.addemar.com.UNOFFICIAL Ah, ok...remove the .UNOFFICIAL off the end and restart clamd. Cheers, Steve Sanesecurity.com ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Win.Trojan.Genieo
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Wed, Dec 3, 2014 at 12:59 PM, Al Varnell alvarn...@mac.com wrote: I believe this signature has been mislabeled as Windows only. The signature comes back as: VIRUS NAME: Win.Trojan.Genieo TARGET TYPE: MACHO OFFSET: * DECODED SIGNATURE: okup__ZL20dtor_genieo_06041979v___tcf_0 stub which tells me it’s an OS X executable. Since it’s neither a false positive or false negative, I wasn’t sure how to report it. -Al- -- Al Varnell Mountain View, CA ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] clamav installation on Ubuntu 14.10
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Fri, Dec 5, 2014 at 5:35 AM, Raj, Dilip dilip@arris.com wrote: Hi, I have several Ubuntu Server, and I wanted to deploy Clamav. I don't want to have all my server connect to internet and grab In a Troubleshooting section of Clamav web site, it says it can be done. Clamav Server: My main clamav server ( 192.168.75.125) ( which will connect to internet and download main.cvd and other .cvd file. The freshclam download the *.cvd files from http://database.clamav.net. How do I configure it so it can dump this into webserver's DocumentRoot. My clamav server is configured with LAMP config on a Ubuntu 14.10. Clients: My other Ubuntu Clients will connect to clamav server ( 192.168.75.125) and download this main.cvd and other files. Client is also Ubuntu 10.10. This below notes is directly from clamav Web site. 1. The second possible solution is to configure a local webserver on one of your machines (say machine1.mylan) and let freshclam download the *.cvd files from http://database.clamav.net to the webserver's DocumentRoot. Finally, change freshclam.conf on your clients so that it reads: DatabaseMirror machine1.mylan. First the database will be downloaded to the local webserver and then the other clients on the network will update their copy of the database from it. For this to work, you have to add ScriptedUpdates off on all of your machines! Thanks. Dilip ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Clamsubmit option -p
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Mon, Dec 1, 2014 at 10:30 PM, Benny Pedersen m...@junc.eu wrote: On 1. dec. 2014 15.58.15 Shawn Webb sw...@sourcefire.com wrote: No need to extract files prior to submission, though it would certainly accelerate analysis if you did. The acronym FP means False Positive--a file that erroneously caused ClamAV to report a virus. The acronym FN means False Negative--a file that was erroneously reported as clean by ClamAV. Thanks now i know the diffrence, will submit some fn, currently only detected with foxhole, but i think the real virus/malware should be detected undepended of archive extension ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Mirroring Problems with db.de.clamav.net and safebrowsing
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Mon, Nov 24, 2014 at 6:37 PM, Matthias Egger maeg...@ee.ethz.ch wrote: Hello List I just checked the logfiles back until october 2014 and saw, that we got often safebrowsing-N.cdiff not found on remote server when we tried downloading the file from db.de.clamav.net. 2 times from 212.227.138.145 15 times from 62.245.181.53 41 times from 88.198.17.100 Are these mirrors just not aware that they should now mirror a safebrowsing-N.cdiff File? Or should i use another URL (db.??.clamav.net) to download (and which url in that case?). Best regards Matthias -- Matthias Egger ETH Zurich Department of Information Technology maeg...@ee.ethz.ch and Electrical Engineering IT Support Group (ISG.EE), ETL/F/24.1 Phone +41 (0)44 632 03 90 Physikstrasse 3, CH-8092 Zurich Fax +41 (0)44 632 11 95 ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] cannot find clamav-devel-latest.tar.gz anymore...
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Wed, Nov 26, 2014 at 8:09 PM, Joel Esler (jesler) jes...@cisco.com wrote: I'll take a look, probably won't happen before Thanksgiving here in the US though. Most of the critical people are on vacation. From: clamav-users [clamav-users-boun...@lists.clamav.net] on behalf of Heino Backhaus [heino.backh...@fink-computer.de] Sent: Wednesday, November 26, 2014 9:38 AM To: ClamAV users ML Subject: Re: [clamav-users] cannot find clamav-devel-latest.tar.gz anymore... i would realy appreciate that ;-) Thanks for your effort. Mit freundlichen Gruessen H. Backhaus Fink-Computer Systeme Heggrabenstr. 9, 35435 Wettenberg Email: heino.backh...@fink-computer.de Web: www.fink-computer.de Fax: +49-641-98444638 Fon: +49-641-98444640 UST-ID: DE151040770 HRB: 2143 Gießen GF: Fredi Fink I was gratified to be able to answer promptly, and I did. I said I didn't know. -Mark Twain Am 26.11.2014 15:26, schrieb Joel Esler (jesler): Well I imagine this probably happened when we switched from the old website to the new website. I wasn't aware that we were producing daily builds. I'll talk it over with the team and see if this is something we want to include on the new site. -- Joel Esler Open Source Manager Threat Intelligence Team Lead Talos On Nov 26, 2014, at 7:42 AM, Heino Backhaus heino.backh...@fink-computer.de wrote: Hello List, i'm using http://www.clamav.net/snapshot/clamav-devel-latest.tar.gz as source for an automated daily upgrade-script since about 10 Years on 15 +x MailScanner machines and it worked perfectly (thanks for that). My problem ist that this file just doesn't exist since version: ClamAV devel-20140826/19682/Wed Nov 26 06:40:34 2014. Haven't I searched hard enough ? -- Mit freundlichen Gruessen H. Backhaus Fink-Computer Systeme Heggrabenstr. 9, 35435 Wettenberg Email: heino.backh...@fink-computer.de Web: www.fink-computer.de Fax: +49-641-98444638 Fon: +49-641-98444640 UST-ID: DE151040770 HRB: 2143 Gießen GF: Fredi Fink I was gratified to be able to answer promptly, and I did. I said I didn't know. -Mark Twain ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] detection of really old viruses?
Respected Sir/Madam, Could you tell me step-wise how to install stable version 0.98.5 from source code in ubuntu??? --- Naresh On Sun, Nov 23, 2014 at 10:02 AM, Marcel Giannelia i...@skeena.net wrote: On Sat, 22 Nov 2014 18:53:58 -0800 Al Varnell alvarn...@mac.com wrote: AFAIK, definitions exist forever unless they have been found to cause False Positives. You can normally find the date a definition was added by searching the clamav-virusdb archive: http://lurker.clamav.net/list/clamav-virusdb.en.html Confirmed; e.g. searching that list for CIH (a.k.a. Chernobyl, from about 1998 or 99) shows W95.CIH-II.882 and some variants were added to the defs in about 2003. sigtool -l of the current main.cvd shows that these definitions are still present in current. Thanks, ~Felix. ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
[clamav-users] Regarding Clamav 0.98.5 installation from source code
Since building 0.98.5 I am seeing ERROR: This tool requires libclamav with functionality level 79 or higher (current f-level: 77) when updating rules. I assume I have some mis-configuration but what? ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Regarding the Clamav 0.98.4 installation
after that i have entered clamscan command but i got following output LibClamAV Error: cl_load(): No such file or directory: /usr/local/share/clamav ERROR: Can't get file status --- SCAN SUMMARY --- Known viruses: 0 Engine version: 0.98.4 Scanned directories: 0 Scanned files: 0 Infected files: 0 Data scanned: 0.00 MB Data read: 0.00 MB (ratio 0.00:1) Time: 0.000 sec (0 m 0 s) root@crypto-HP-Compaq-8000-Elite-CMT-PC:/home/crypto/Downloads/clamav-0.98.4# On Fri, Nov 14, 2014 at 11:45 AM, naresh hcu nareshhc...@gmail.com wrote: Respected sir, Initially i have typed ./configure then i got one message that message i have attached below in ./configure file, After that i have typed make , when do make check i am getting below errors make[3]: Leaving directory `/home/crypto/Downloads/clamav-0.98.4/unit_tests' make[2]: Leaving directory `/home/crypto/Downloads/clamav-0.98.4/unit_tests' make[1]: Leaving directory `/home/crypto/Downloads/clamav-0.98.4/unit_tests' make[1]: Entering directory `/home/crypto/Downloads/clamav-0.98.4' make[1]: Leaving directory `/home/crypto/Downloads/clamav-0.98.4' Sir, plz tell me how to install from source I would be grateful, if you do help to me !Thans in advance On Fri, Nov 14, 2014 at 2:59 AM, Stuart Henderson stu-clamav-l...@spacehopper.org wrote: On 2014/11/13 22:32, naresh hcu wrote: Sir, I have successfully installed calmav f rom clamav packags but i want to install it from source code i am getting errors , this is task is a part of my M.Tech project Could you help me Sir, Thanking sir, Naresh There isn't really enough information in your email for anyone to be able to help you. You'll need to be more specific - what exactly did you type, what errors did you see? (copy-and-paste the messages). Recommended reading: http://www.chiark.greenend.org.uk/~sgtatham/bugs.html ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] ClamAV Splunk app
Respected sir, Did you check it on your ubuntu 14.04 system On Sat, Nov 15, 2014 at 11:25 PM, Dennis Peterson denni...@inetnw.com wrote: On 11/15/14 9:22 AM, G.W. Haywood wrote: Hi there, On Sat, 15 Nov 2014, PJ Balsley wrote: I use clamav on hundreds of linux systems in our network. ... This is not a facetious question, it's one of genuine interest. Why? I did it too and the reason is compliance with credit card/social security regulations. dp ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] ClamAV Splunk app
Sir, What i am asking , what your tellingplz run calm av 9.8 from source on your linux machine and see whether it is compiling or not , if it is executing successfully then let me know... On Sat, Nov 15, 2014 at 1:17 AM, PJ Balsley pbals...@ragingwire.com wrote: This is not an advertisement, this is a request for features. I use clamav on hundreds of linux systems in our network. In an effort to get visibility scan results I created a Splunk app. While I've built reports and dashboards that are helpful to our organization, I would like to improve it to benefit other users. I figured this was a good place to ask. I have reports on: # of completed scans # of Risks detected Hosts most at risk Top 10 virus category Top 10 infected files Scan time/duration by host ClamAV errors DLP scan summary PUA scan summary Quarantined file summary You are welcome to let me know what updates, reports, etc... you would like to see in the app. What do you care about? Splunk app: ClamAV Link: https://apps.splunk.com/app/1798/ Thank you for your time! PJ ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
[clamav-users] Regarding the Clamav 0.98.4 installation
Respected Sir/Madam, I, Banoth Naresh pursuing Mtech at University of Hyderabad, this is inform that , i am unable to install Clamav 0.98.4 from source code , i did ./configure, make , make install after that we have have to install freshclam but i got errors so many times, could you help me how to install through terminal from source code... Thanking you Sir/Madam Your faithfully, Banoth Naresh ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Regarding the Clamav 0.98.4 installation
Ubuntu 14.04 On Thu, Nov 13, 2014 at 6:33 PM, Matus UHLAR - fantomas uh...@fantomas.sk wrote: On 13.11.14 17:36, naresh hcu wrote: Respected Sir/Madam, I, Banoth Naresh pursuing Mtech at University of Hyderabad, this is inform that , i am unable to install Clamav 0.98.4 from source code , i did ./configure, make , make install after that we have have to install freshclam but i got errors so many times, could you help me how to install through terminal from source code... what OS od distribution do you use? Linux ... ? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. A day without sunshine is like, night. ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
Re: [clamav-users] Regarding the Clamav 0.98.4 installation
Sir, I have successfully installed calmav f rom clamav packags but i want to install it from source code i am getting errors , this is task is a part of my M.Tech project Could you help me Sir, Thanking sir, Naresh On Thu, Nov 13, 2014 at 7:38 PM, Matus UHLAR - fantomas uh...@fantomas.sk wrote: On 13.11.14 17:36, naresh hcu wrote: I, Banoth Naresh pursuing Mtech at University of Hyderabad, this is inform that , i am unable to install Clamav 0.98.4 from source code , i did ./configure, make , make install after that we have have to install freshclam but i got errors so many times, could you help me how to install through terminal from source code... On 13.11.14 19:07, naresh hcu wrote: Ubuntu 14.04 why from sources? ubuntu does provide clamav packages, and 0.98.4 is avbailable in backports... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. On the other hand, you have different fingers. ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml ___ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
