Re: [Clamav-users] small app to de-MIME attachments?

2003-08-14 Thread TwinsPop
On Mon, Aug 11, 2003 at 10:55:54AM +0200, Tomasz Papszun wrote: With --mbox option clamscan does handle attachments. At least it Hrmf. Not here. mail:~/Maildir/cur (106) % cat 1057682150.37472_57:2,S | clamscan --mbox - LibClamAV Error: Not a valid mail message snip should. I mean that

Re: [Clamav-users] virus.db2 md5 mismatch

2003-08-14 Thread Omar Kilani
Daniel, The thing is, it was like that for around 30 minutes from when I first got the error. And I tried all the other mirrors, and they had the bad md5sum as well. As a side note, I didn't actually see Thomas' post since SF seems to be so slow in processing mailing list traffic. So I'm sorry

Re: [Clamav-users] Compiling on one machine to run on another...

2003-08-14 Thread Tomasz Kojm
On Tue, 5 Aug 2003 00:15:26 +0200 Tomasz Kojm [EMAIL PROTECTED] wrote: On Mon, 04 Aug 2003 22:19:26 +0100 Andy [EMAIL PROTECTED] wrote: OK, so it doesn't run that fast on the machine, but it's only checking incoming mail so it has as long as it takes... There is no problem with the

Re: [Clamav-users] libclamav cl_scan* strings (0.60)

2003-08-14 Thread Julien Benoist
On Wed, 6 Aug 2003, Tomasz Kojm wrote: On Wed, 6 Aug 2003 15:05:46 + (UTC) Julien Benoist [EMAIL PROTECTED] wrote: Is there a trivial way to scan strings *with* CL_ARCHIVE CL_MAIL support ? No, there isn't. pipe(pfd); write(pfd[1],buffer,strlen(buffer));

[Clamav-users] STREAM ports

2003-08-14 Thread Dennis Skinner
Hello, I've just started looking at the STREAM command to clamd. What is the port range that it randomly chooses from? So far I have seen as low as 4700 and upwards of 59000. The docs seem a little sparse in describing this functionality. I looked briefly at the source code, but I thought

Re: [Clamav-users] Error when scanning plain-mail files

2003-08-14 Thread Tomasz Papszun
On Tue, 12 Aug 2003 at 13:32:44 +0200, Diego d'Ambra wrote: It seems that ClamAV fails to scan inside plain mail files when the option --mbox is used. That's right. I noticed that yesterday. I believe this feature was included in earlier versions of ClamAV. That error was introduced only in

Multidrop - was [Clamav-users] signature W95/Elkern

2003-08-14 Thread frost
Thanks for the answer. -1 problem in my to-do-list ;-) Another problem: - Suse 8.2 with amavisd-new, clamav and postfix - AND multidrop-box the problem: the reinjection from amavisd to localhost add a receive-line like: ... receive .. for [EMAIL PROTECTED] If you get the box with a program

[Clamav-users] MSBlast

2003-08-14 Thread W.D. McKinney
Is the MSBlast worm in clamav db2 yet ? http://clamav.elektrapro.com/cgi-bin/sendvirus.cgi does not show it ? Dee --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are

Re: [Clamav-users] small app to de-MIME attachments?

2003-08-14 Thread TwinsPop
Ah. Found something that will help anyway: reformime from the maildrop package. (Referenced on the amavis page, which I started looking at after Tomasz's email.) % cat msg | reformime 1 1.1 1.2 So there are 2 attachments. Check each one: % cat msg | reformime -e -s 1.1 | clamscan -

[Clamav-users] (no subject)

2003-08-14 Thread sylvain angers
Hi everyone, I am begging some thought about this one. I just finish installing amavis-ng-0.1.6.4-03.noarch.rpm on Mitel SME 5.6 U4 I get some mail under /var/spool/amavis-ng/problems it say AMAVIS::AV::CLAMD cannot connect to /var/lib/clamav/clamd.sock error while scanning for virus with

Re: [Clamav-users] Error when scanning plain-mail files

2003-08-14 Thread Nigel Horne
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tuesday 12 Aug 2003 1:11 pm, Tomasz Papszun wrote: LibClamAV debug: Starting scanmail() LibClamAV debug: in mbox() clamscan: mbox.c:250: cl_mbox: Assertion `!first' failed. I noticed this on Sunday and have sent Tomasz a patch. - -Nigel -

Re: [Clamav-users] libclamav cl_scan* strings (0.60)

2003-08-14 Thread Tomasz Kojm
On Wed, 6 Aug 2003 22:10:51 + (UTC) Julien Benoist [EMAIL PROTECTED] wrote: You should save all data to a temporary file and run cl_scandesc on it. Agreed, but i actually wanted to avoid it for performance reasons. Oh, I think it's a missed idea - what about really big attachments ?

Re: [Clamav-users] small app to de-MIME attachments?

2003-08-14 Thread Tomasz Papszun
On Mon, 11 Aug 2003 at 12:43:46 -0700, TwinsPop wrote: Ah. Found something that will help anyway: reformime from the maildrop package. (Referenced on the amavis page, which I started looking at after Tomasz's email.) % cat msg | reformime 1 1.1 1.2 So there are 2 attachments.

Re: [Clamav-users] virus.db2 md5 mismatch

2003-08-14 Thread Tomasz Kojm
On 14 Aug 2003 10:28:36 -0500 Daniel J McDonald [EMAIL PROTECTED] wrote: That's generally the case while an update is in progress. I'll occassionally find a mismatch and it's generally cleaned up 5 minutes later. That shouldn't be frequent because we always update the md5 sums at the end, so

Re: [Clamav-users] signature W95/Elkern

2003-08-14 Thread Tomasz Papszun
On Thu, 14 Aug 2003 at 16:12:39 +0200, Tomasz Papszun wrote: On Thu, 14 Aug 2003 at 15:45:28 +0200, [EMAIL PROTECTED] wrote: Hi, are there anyone who are able to check signature in a windows-exe-file. ClamAV reject mails because finding W95/Elkern, CAI, trend-micro don't find anything.

Re: [Clamav-users] lots of sig 11 core dumps

2003-08-14 Thread Tomasz Kojm
On Wed, 6 Aug 2003 11:01:43 -0700 Kelsey Cummings [EMAIL PROTECTED] wrote: properly.) Are these problems common or are they indictive of some other problem with my build or? Unfortunately this is a standard problem with clamd and clamav-milter from 0.60. The problem is in our mail scanning

[Clamav-users] FW: Freshclam bad viruses.db2 db checksum

2003-08-14 Thread Spicer, Kevin
Theres a thread over on the MailScanner mailing list which suggests there may be a problem with the viruses.db2 file on clamav.elektrapro.com. I've included part of the thread below... NTIN Page Guy wrote: Hello Matthew, I had to change my mirror for ClamAV this morning as well. It

Re: [Clamav-users] ScanMail feature

2003-08-14 Thread Thomas Lamy
Leonardo Canducci wrote: I'm testing it with simple text mails and no attachments (i.e. mail -s test [EMAIL PROTECTED]) It seems that clamd dies when scanning mails since I got this output after the first scan: Please disable ScanMail and try again. Best regards, Tomasz Kojm ok. now

Re: [Clamav-users] ScanMail feature

2003-08-14 Thread Leonardo Canducci
On Sun, Aug 10, 2003 at 08:49:34PM +0200, Thomas Lamy wrote: I couldn't find information about it in the docs. Well, it's in the AMaViS docs. Amavis is taking care of extracting could you please me post me a link? grep -ri scanmail /usr/share/doc/amavis-ng gave me no hints. attachments

[Clamav-users] FW: Freshclam bad viruses.db2 db checksum

2003-08-14 Thread Spicer, Kevin
Theres a thread over on the MailScanner mailing list which suggests there may be a problem with the viruses.db2 file on clamav.elektrapro.com. I've included part of the thread below... NTIN Page Guy wrote: Hello Matthew, I had to change my mirror for ClamAV this morning as well. It

Re: [Clamav-users] virus.db2 md5 mismatch

2003-08-14 Thread Daniel J McDonald
On Thu, 2003-08-14 at 09:33, Omar Kilani wrote: Hello, I received a virus.db2 md5 mismatch today -- I'm using the www.clamav.com mirror. It now appears to be fixed, but just thought I'd let people know just incase the website has been compromised. That's generally the case while an

[Clamav-users] signature W95/Elkern

2003-08-14 Thread frost
Hi, are there anyone who are able to check signature in a windows-exe-file. ClamAV reject mails because finding W95/Elkern, CAI, trend-micro don't find anything. And now? ... TNX! regards Juergen Frost -- r.z.w. cimdata AG Zum Hospitalgraben 2 99425 Weimar Tel: +49 (0) 3643 8640 0 Fax: +49

Re: [Clamav-users] signature W95/Elkern

2003-08-14 Thread Tomasz Papszun
On Thu, 14 Aug 2003 at 15:45:28 +0200, [EMAIL PROTECTED] wrote: Hi, are there anyone who are able to check signature in a windows-exe-file. ClamAV reject mails because finding W95/Elkern, CAI, trend-micro don't find anything. And now? ... TNX! regards Juergen Frost You can send this

[Clamav-users] Re: STREAM ports

2003-08-14 Thread Dennis Skinner
Never failsI find the answer just after I hit send if((port = rndnum(6)) 1024) port += 2139; Looks like 1024 to 6 (with a slightly higher preference for ports roughly 2139 thru 3162). So.thoughts on security? :) On Wed, 2003-08-13 at 12:02, Dennis Skinner wrote: Hello,

Re: [Clamav-users] MSBlast

2003-08-14 Thread W.D. McKinney
Thanks a bunch. Dee On Tue, 2003-08-12 at 19:15, Nicholas Chua wrote: W.D. McKinney wrote: Is the MSBlast worm in clamav db2 yet ? http://clamav.elektrapro.com/cgi-bin/sendvirus.cgi does not show it ? If i am not wrong, it is been detected as Worm.Blaster.A

Re: [Clamav-users] Error when scanning plain-mail files

2003-08-14 Thread Tomasz Kojm
On Tue, 12 Aug 2003 13:32:44 +0200 Diego d'Ambra [EMAIL PROTECTED] wrote: It seems that ClamAV fails to scan inside plain mail files when the option --mbox is used. Only mbox files are supported, clamscan never supported raw mail files. Best regards, Tomasz Kojm -- oo.

Re: [Clamav-users] small app to de-MIME attachments?

2003-08-14 Thread Tomasz Papszun
On Mon, 11 Aug 2003 at 12:32:26 -0700, TwinsPop wrote: On Mon, Aug 11, 2003 at 10:55:54AM +0200, Tomasz Papszun wrote: With --mbox option clamscan does handle attachments. At least it Hrmf. Not here. mail:~/Maildir/cur (106) % cat 1057682150.37472_57:2,S | clamscan --mbox - LibClamAV

Re: [Clamav-users] Error when scanning plain-mail files

2003-08-14 Thread Tomasz Papszun
On Tue, 12 Aug 2003 at 14:11:11 +0200, Tomasz Papszun wrote: I'm attaching the patch for libclamav/scanners.c. Of course, I forgot to add the attachment :-( . -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros.

[Clamav-users] small app to de-MIME attachments?

2003-08-14 Thread TwinsPop
How best to grab attachments from email msgs? My first hopeful attempt was to pipe the msgs right into clamscan, but apparently it doesn't handle encoded email attachments. :-/ (Please correct me if I'm wrong!) I've played with a few command line utils, but none handle multiple attachments well.

Re: [Clamav-users] defunct clamd again

2003-08-14 Thread Scott Kveton
snip clamav.log says nothing. any hints? Hi Leonardo, I had the same problem and received the following reply from Tomasz: This is a problem with the zziplib library, We've already received some zip samples that cause a segfault and are working on it. I think, you can safely disable

[Clamav-users] Re: new to this

2003-08-14 Thread Luca Gibelli
Hi Lehua, the new mailing-list address is [EMAIL PROTECTED] Please remember it for your future posting. I'm forwarding your email to the new address. I'm trying to install clamav and am getting stuck at the $make install step. I'm getting a permission denied. My purpose for installation

Re: [Clamav-users] Queries on Clam AV

2003-08-14 Thread ODHIAMBO Washington
* Darren Keech [EMAIL PROTECTED] [20030815 06:26]: wrote: Hi Guys, I have setup Clam on my linux box and wondering how do I go about scanning my entire system? man clamsdscan. I will be setting this up as a Cron job to run every fortnight to a month (I haven't decided yet). Also how do

Re: [Clamav-users] Queries on Clam AV

2003-08-14 Thread Michael Sullenszino
Yes, please read all of the documentation on the web site. It explains most of your questions. Also, check out the man pages for clamscan, clamd and freshclam. There are explanations and examples. There are also copious examples of cron jobs in the clam documentation and on google. Mike

Re: [Clamav-users] lots of sig 11 core dumps

2003-08-14 Thread Tomasz Kojm
On Wed, 6 Aug 2003 14:10:03 -0700 Kelsey Cummings [EMAIL PROTECTED] wrote: Good to know. I'll try to catch/recreate the segfaults and ship off the offending email to you. Please use the cvs version or copy the attached (bziped) source file to the clamav-x.yz/libclamav directory and recompile

Re: [Clamav-users] libclamav cl_scan* strings (0.60)

2003-08-14 Thread Tomasz Kojm
On Wed, 6 Aug 2003 15:05:46 + (UTC) Julien Benoist [EMAIL PROTECTED] wrote: Is there a trivial way to scan strings *with* CL_ARCHIVE CL_MAIL support ? No, there isn't. pipe(pfd); write(pfd[1],buffer,strlen(buffer)); close(pfd[1]); First thing - the code above is broken. When