[Clamav-users] request: clamav-milter trusted IP

2004-05-25 Thread Ron Norton
Hi There, We use sendmail with clam & spamassassin (clamav-milter + spamass-milter). When a message is routed across several MX servers to final destination, it is scanned by clamd multiple times on each MX server. In spamassassin we can configure spamass-milter with the -i option NOT to scan twi

Re: [Clamav-users] Problems with clamav-0.71 and Digital Sigs

2004-05-25 Thread George Chelidze
Hello, You also need gmp-devel Best Regards, Darren Honeyball [ML] wrote: On Solaris 9... I've downloaded, compiled and installed gmp-4.1.3 but doing a ./configure on clamav-0.71 gives: checking for __gmpz_init in -lgmp... no checking for mpz_init in -lgmp... no WARNING: GNU MP 2 or newer NOT FOUND

[Clamav-users] Re: request: clamav-milter trusted IP

2004-05-25 Thread Nigel Horne
Look in clamav-milter/clamav-milter.c for this statement: static const char *localAddresses[] = { and amend it for your requirements. Then ensure you don't use the --force or --local options. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#2

[Clamav-users] Re: Suspicious?

2004-05-25 Thread Patrick Beard
> I'm not up on all of the exploits for the browsers, but I'm suspicious of > this because it looks to me like it's trying to hide at the top left of the > screen. I've downloaded the .cab file and clamav doesn't see anything wrong > with it. Google doesn't find any answers about the clsid string

Re: [Clamav-users] Clamv-milter

2004-05-25 Thread Cristian Del Carlo
On May 24, 2004 06:22 PM, Nigel Horne <[EMAIL PROTECTED]> wrote: > On Monday 24 May 2004 14:38, Cristian Del Carlo wrote: > > >  I have a problem when my users send e-mails greater than 400-500K becouse i have > > from the server the follwing error : > >   > >  May 24 12:53:50 X sm-mta[1745

[Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Jim Gunkel
"Jim Maul" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > Any more ideas? I just installed ClamAV 0.71 (Windows build devel-20040520) today (upgraded from 0.70) and now I'm getting virii through to our email accounts with similar symptoms. One of the original unmodified emails that

[Clamav-users] Re: Suspicious?

2004-05-25 Thread Patrick Beard
> I'm not up on all of the exploits for the browsers, but I'm suspicious of > this because it looks to me like it's trying to hide at the top left of the > screen. I've downloaded the .cab file and clamav doesn't see anything wrong > with it. Google doesn't find any answers about the clsid string

Re: [Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Fajar A. Nugraha
Jim Gunkel wrote: "Jim Maul" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] Any more ideas? I just installed ClamAV 0.71 (Windows build devel-20040520) today (upgraded from 0.70) and now I'm getting virii through to our email accounts with similar symptoms. One of the original

Re: [Clamav-users] Donations

2004-05-25 Thread Tomasz Kojm
On Mon, 24 May 2004 22:18:11 -0500 Phil Schilling <[EMAIL PROTECTED]> wrote: > You, as a team, really need to find something else for a clearing > house for donations. I tried to send money on Saturday and their > website was fsck'ed up. They sent me an email today saying it was > fixed and stil

Re: [Clamav-users] Problems with clamav-0.71 and Digital Sigs

2004-05-25 Thread Darren Honeyball [ML]
Peter Bonivart wrote: Darren Honeyball [ML] wrote: On Solaris 9... I've downloaded, compiled and installed gmp-4.1.3 but doing a ./configure on clamav-0.71 gives: checking for __gmpz_init in -lgmp... no checking for mpz_init in -lgmp... no WARNING: GNU MP 2 or newer NOT FOUND - digital signature su

RE: [Clamav-users] Mail bombs

2004-05-25 Thread João Filipe Frade
> > After I updated clamd to the latest version (0.71) it > stopped detecting (and avoiding) mailbombs. > > (i used the test mail-bomb from amavisd-new) > > Has anyone noticed this problem? > > > > I use RH9 with amavisd-new. clam was installed from a compiled RPM. > > Please try the latest vers

Re: [Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Nigel Horne
On Tuesday 25 May 2004 09:34, Jim Gunkel wrote: > I just installed ClamAV 0.71 (Windows build devel-20040520) today (upgraded > from 0.70) and now I'm getting virii through to our email accounts with > similar symptoms. > > One of the original unmodified emails that is causing problems can be > d

RE: [Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Nigel Horne
> One of the original unmodified emails that is causing problems can be > downloaded from http://www.nevrona.com/virus.txt > C:\MailServer\VirusTemp>\clamav-devel\bin\clamscan.exe --mbox virus.eml I'm confused. At the start you said that the 'original unmodified' email is called virus.txt, but la

[Clamav-users] freshclam: NotifyClamd or not NotifyClamd

2004-05-25 Thread Samuel Benzaquen
Hi all, We've been running clamd / clamav-milter for some weeks without problems, but this morning one of the clamd processes hanged up on freshclam's notification. We have 8 RH7.3 Linux servers, running sendmail 8.12.11 + clamd / ClamAV version 0.70, clamav-milter version 0.70j. 7 out of 8 serv

Re: [Clamav-users] freshclam: NotifyClamd or not NotifyClamd

2004-05-25 Thread Trog
On Tue, 2004-05-25 at 13:59, Samuel Benzaquen wrote: > Hi all, > > We've been running clamd / clamav-milter for some weeks without problems, > but this morning one of the clamd processes hanged up on freshclam's > notification. > > We have 8 RH7.3 Linux servers, running sendmail 8.12.11 + clamd /

[Clamav-users] quarantine files

2004-05-25 Thread Steven Stern
It seems that one of the changes from .70 to .71 is that the files in the quarantine directory are now stored in subdirectories based on the date. Have there been any changes in how long these files are kept before deletion? Are the subdirectories deleted along with the files? # ll /var/spool/cl

[Clamav-users] -t option for clamav-milter

2004-05-25 Thread Steven Stern
According to the man page, I should be able to use "=t" as an option for clamav-milter with no further argument. The page says that if no file name is supplied, a hard coded default is used. When I use just "-t", the error is Starting clamav-milter: /usr/sbin/clamav-milter: option requires an ar

RE: [Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Jim Maul
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Jim Gunkel > Sent: Tuesday, May 25, 2004 4:34 AM > To: [EMAIL PROTECTED] > Subject: [Clamav-users] Re: Question regarding virus detection > > > "Jim Maul" <[EMAIL PROTECTED]> wrote in message > news:[EMAI

[Clamav-users] Bug with 0.71 not limiting archive scans? (e.g. 42.zip)

2004-05-25 Thread Jason Haar
I've just tried running clamdscan and clamscan over 42.zip (with archive limits enabled) and it doesn't exit in any decent time (i.e. it's still running 15 minutes later at 99% CPU). e.g clamscan -v --debug --max-files=100 --max-recursion=4 42.zip The strange thing is it reports things like: Lib

RE: [Clamav-users] freshclam: NotifyClamd or not NotifyClamd

2004-05-25 Thread Samuel Benzaquen
> -Mensaje original- > De: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] nombre de Trog > Enviado el: Martes, 25 de Mayo de 2004 09:28 a.m. > Para: [EMAIL PROTECTED] > Asunto: Re: [Clamav-users] freshclam: NotifyClamd or not NotifyClamd > > > On Tue, 2004-05-25 at 13:59, Samuel Benzaquen

RE: [Clamav-users] freshclam: NotifyClamd or not NotifyClamd

2004-05-25 Thread Trog
On Tue, 2004-05-25 at 15:41, Samuel Benzaquen wrote: > > Upgrade to 0.71. > > > > It was most likely waiting for a scanning thread to finish, which it has > > to do before it can reload the sig DB. If a scanning thread fails to > > finish, that indicates a bug in the scanner somewhere (which may ha

[Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Jim Gunkel
"Nigel Horne" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > > One of the original unmodified emails that is causing problems can be > > downloaded from http://www.nevrona.com/virus.txt > > > C:\MailServer\VirusTemp>\clamav-devel\bin\clamscan.exe --mbox virus.eml > > I'm confused. At

RE: [Clamav-users] Re: Suspicious?

2004-05-25 Thread Ron Snyder
> I've found a few bits of spy/adware that everything missed. > You can download > a trial at www.norman.com . > > I should say that I don't have any connection with this > company except as a > end user. > > Below is a example of what it reports. > > Cheers, > Patrick > > ALARM: > Virus infe

Re: [Clamav-users] Mail bombs

2004-05-25 Thread Nigel Horne
> Tested with clamav-devel-20040524 and the problem remains. Where can I download a sample which reproduces the problem? > Joao Frade -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk ---

[Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Jim Gunkel
"Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > I tested your file on a W2K server, with 0.71 and devel-20040524, both > found the virus. > Try updating your installation. It was the latest available from http://www.sosdg.org/clamav-win32/index.php as of yesterday.

[Clamav-users] blocking attachments

2004-05-25 Thread Ken Jones
Is it possible to configure clamav to block certain types of attachements even if they do not have a virus? Thanks, Ken Jones --- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle

Re: [Clamav-users] -t option for clamav-milter

2004-05-25 Thread Nigel Horne
On Tuesday 25 May 2004 15:04, Steven Stern wrote: > The page says that if no file name is > supplied, a hard coded default is used. That's wrong. It should say 'If the -t option is not given, a hard coded default is used as the warning message'. I'll update the documentation - thanks for pointi

RE: [Clamav-users] Mail bombs

2004-05-25 Thread João Filipe Frade
> > Tested with clamav-devel-20040524 and the problem remains. > > Where can I download a sample which reproduces the problem? Download Amavisd-new and use the test message "sample-42-mail-bomb.txt". Jason Haar as reported the same problem (subject: Bug with 0.71 not limiting archive scans? (e.

RE: [Clamav-users] blocking attachments

2004-05-25 Thread Jim Maul
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Ken Jones > Sent: Tuesday, May 25, 2004 12:12 PM > To: [EMAIL PROTECTED] > Subject: [Clamav-users] blocking attachments > > > Is it possible to configure clamav to block certain > types of attachements ev

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Micheal Patterson
- Original Message - From: "Ken Jones" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, May 25, 2004 11:12 AM Subject: [Clamav-users] blocking attachments > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? > > Thank

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Matt
On Tue, 25 May 2004 11:12:18 -0500 Ken Jones wrote: > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? > > Thanks, > Ken Jones > > Best way to do that is in the mail filter script/software. Matt -

Re: [Clamav-users] Mail bombs

2004-05-25 Thread Nigel Horne
On Tuesday 25 May 2004 18:02, João Filipe Frade wrote: > > > Tested with clamav-devel-20040524 and the problem remains. > > > > Where can I download a sample which reproduces the problem? > > Download Amavisd-new and use the test message "sample-42-mail-bomb.txt". I don't use that software. May

Re: [Clamav-users] FYI: clamd-0.71 still hanging on FreeBSD 4.8-RELEASE

2004-05-25 Thread Tomasz Kojm
On Mon, 24 May 2004 10:05:23 -0400 Jesse Guardiani <[EMAIL PROTECTED]> wrote: > FYI: > > This problem has existed since somewhere between clamd-0.70-rc > and clamd-0.70 (stable). I'm working around it by running a > UNIX socket check via monit every 30 seconds or so. clamd hangs > between 5 and 8

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Nigel Horne
On Tuesday 25 May 2004 17:12, Ken Jones wrote: > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? That is not the job of a virus scanner, so the answer is no. > Ken Jones -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Ba

Re: [Clamav-users] Bug with 0.71 not limiting archive scans? (e.g. 42.zip)

2004-05-25 Thread Tomasz Kojm
On Wed, 26 May 2004 02:06:45 +1200 Jason Haar <[EMAIL PROTECTED]> wrote: > I've just tried running clamdscan and clamscan over 42.zip (with > archive limits enabled) and it doesn't exit in any decent time (i.e. > it's still running 15 minutes later at 99% CPU). > > e.g > > clamscan -v --debug --

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Kevin Spicer
On Tue, 2004-05-25 at 17:12, Ken Jones wrote: > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? > Take a look at MailScanner http://www.mailscanner.info it offers a number of ways to apply all sorts of policy to email. signature.asc

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Kevin Spicer
On Tue, 2004-05-25 at 17:12, Ken Jones wrote: > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? > Take a look at MailScanner http://www.mailscanner.info it offers a number of ways to apply all sorts of policy to email. BMRB Interna

Re: [Clamav-users] blocking attachments

2004-05-25 Thread Kevin Spicer
On Tue, 2004-05-25 at 17:12, Ken Jones wrote: > Is it possible to configure clamav to block certain > types of attachements even if they do not have a virus? > Take a look at MailScanner http://www.mailscanner.info it offers a number of ways to apply all sorts of policy to email. signature.asc

Re: [Clamav-users] Re: Question regarding virus detection

2004-05-25 Thread Fajar A. Nugraha
Jim Gunkel wrote: "Fajar A. Nugraha" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] I tested your file on a W2K server, with 0.71 and devel-20040524, both found the virus. Try updating your installation. It was the latest available from http://www.sosdg.org/clamav-win32/index.p