[Clamav-users] Re: freshclam: 'Broken or not a CVD file'

2004-10-21 Thread Tim Boyer
On Thu, 14 Oct 2004 01:21:47 +0100, Matt <[EMAIL PROTECTED]> wrote: >Tim Boyer wrote: > >> Downloading daily.cvd [*] >> ERROR: Verification: Broken or not a CVD file >> Giving up... >> >> I went to rc4 last night in the hope that it would be fixed, but I'm >> getting the same error. > > > This is

Re: [Clamav-users] Independent Testing (with STATS!)

2004-10-21 Thread clamav
> Are there any independent tests out there that do not paint such a bleak > picture? Are there any plans to submit ClamAV or ClamWin to Virus > Bulletin? Want stats? We employ clam, uvscan (McAfee/NAI) and bdc. Clam is much faster because of clamd so it is first. Here is the breakdown in orde

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Grant Supp
Andy Fiddaman wrote: I'm not a developer but this looks similar to what I'm seeing on Solaris. Is readdir_r in use here ? (grep READDIR_R clamav-config.h) Can you post the dirent struct from your /usr/include/sys/dirent.h file ? Otherwise the following command should give enough: find /usr/

Re: [Clamav-users] Re: rld: Error:

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 14:28:58 -0500 Dale Bohl <[EMAIL PROTECTED]> wrote: > /home/cheetah/dbohl/proj/hsm/terabyte: OK > /home/cheetah/dbohl/proj/hsm/archiving: OK > /home/cheetah/dbohl/proj/uit/home_links_reasons: OK > LibClamAV Error: Can't create temporary file : No such file or > directory Memory

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Damian Menscher
On Wed, 20 Oct 2004, Rob Dueckman wrote: I'm running mimedefang/spamassassin/clamav on an IRIX 6.5 machine and have found that some files cause both clamd and clamscan to core. Since I'm still running this combo, I can't forward the message to the list, but it can be found at: ftp://ftp.heloc.com/p

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Rob Dueckman
Uggg... I've pulled the latest gdb down and built it. It builds OK, but it won't work properly (complains with the message "warning: Signal ? does not exist on this system." and just sits spinning) SGI's dbx isn't much help either (and I really don't know how to use it :-) I think I'll have to

[Clamav-users] Re: rld: Error:

2004-10-21 Thread Dale Bohl
Tomasz Kojm wrote: On Thu, 21 Oct 2004 10:01:23 -0500 Dale Bohl <[EMAIL PROTECTED]> wrote: Any help will be greatly appreciated on this. I'm on IRIX 6.5.15m - MIPS and trying to install ClamAV 0.75 but cannot. I have installed 0.75 on IRIX 6/5/24m without any issues. 0.75 is no longer supported.

[Clamav-users] RE: update as soon as possible

2004-10-21 Thread Matthew.van.Eerde
Mitch (WebCob) wrote: >> Hi, how do you make ClamAV update virus database as soon as possible >> when the signature becomes ready? >> >> Sam. >> > [Mitch (bitblock)] > Sam. Bad toad! Don't hijack threads. > > You can run freshclam - there is no such thing as an instant > update - the > latest ve

update as soon as possible WAS RE: [Clamav-users] Independent Testing

2004-10-21 Thread Mitch (WebCob)
> Hi, how do you make ClamAV update virus database as soon as possible > when the signature becomes ready? > > Sam. > [Mitch (bitblock)] Sam. Bad toad! Don't hijack threads. You can run freshclam - there is no such thing as an instant update - the latest version uses DNS records to allow more

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 10:09 am, Bogusław Brandys wrote: > I must ask.I have many spam messages in my email folder. Do I consider > sending them as a submission ? Should people know what are the > differences , to stop submit just junk emails? Or it is accepted ? nntp://news.admin.net-abuse.s

Re: [Clamav-users] rld: Error:

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 10:01:23 -0500 Dale Bohl <[EMAIL PROTECTED]> wrote: > Any help will be greatly appreciated on this. > > I'm on IRIX 6.5.15m - MIPS and trying to install > ClamAV 0.75 but cannot. I have installed 0.75 on IRIX > 6/5/24m without any issues. 0.75 is no longer supported. Please

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 17:09:20 +0200 Bogus³aw Brandys <[EMAIL PROTECTED]> wrote: > I must ask.I have many spam messages in my email folder. Do I consider > > sending them as a submission ? Should people know what are the No, we all have billions of them. -- oo. Tomasz Kojm <[

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Trog
On Thu, 2004-10-21 at 16:09, Bogusław Brandys wrote: > I must ask.I have many spam messages in my email folder. Do I consider > sending them as a submission ? Should people know what are the > differences , to stop submit just junk emails? Or it is accepted ? > No. Definitely not. I get over

[Clamav-users] rld: Error:

2004-10-21 Thread Dale Bohl
Any help will be greatly appreciated on this. I'm on IRIX 6.5.15m - MIPS and trying to install ClamAV 0.75 but cannot. I have installed 0.75 on IRIX 6/5/24m without any issues. The ./configure results are attached. The make and make install went fine. When running /usr/local/bin/freshclam I see ch

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Bogusław Brandys
Jeremy Kitchen wrote: On Thursday 21 October 2004 09:46 am, Tomasz Kojm wrote: On Thu, 21 Oct 2004 16:41:23 +0200 Bogusław Brandys <[EMAIL PROTECTED]> wrote: These are different signatures (non MD5 in this case) for different instances of phishing emails. So I wouldn't really call that malware. So

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 09:46 am, Tomasz Kojm wrote: > On Thu, 21 Oct 2004 16:41:23 +0200 > > Bogus³aw Brandys <[EMAIL PROTECTED]> wrote: > > > These are different signatures (non MD5 in this case) for different > > > instances of phishing emails. So I wouldn't really call that > > > malware. >

Re: [Clamav-users] Clamav 0.80 with daemontools ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 08:25 am, Forexys Support Center wrote: > Hi > > i have a small problems with the 0.80 version ... he don't want start > correctly.. > > I have: > > 6616 ?S 0:00 \_ supervise clamd > 6707 ?Z 0:00 | \_ [run] > 6617 ?S 0:00 \

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 16:41:23 +0200 Bogus³aw Brandys <[EMAIL PROTECTED]> wrote: > > These are different signatures (non MD5 in this case) for different > > instances of phishing emails. So I wouldn't really call that > > malware. > > So it is harmless ? Well, that depends on an intelligence of a

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Bogusław Brandys
Trog wrote: On Thu, 2004-10-21 at 14:48, Bogusław Brandys wrote: Hello, Could someone explain why there are sometimes a few signatures for one malware ? Does it mean that malware has small change and that are MD5 signatures ? Well, it depends what the signature is for. Today was for example su

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 15:23:35 +0100 Trog <[EMAIL PROTECTED]> wrote: > Occasionally you'll see sigs like Worm.Bagle.AG.2, which may be a > second signature to match a different instance of the same malware. For example re-packed with a packer we don't support at the moment. -- oo.

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Trog
On Thu, 2004-10-21 at 14:48, Bogusław Brandys wrote: > Hello, > > Could someone explain why there are sometimes a few signatures for one > malware ? Does it mean that malware has small change and that are MD5 > signatures ? Well, it depends what the signature is for. > Today was for example s

[Clamav-users] Please explain ?

2004-10-21 Thread Bogusław Brandys
Hello, Could someone explain why there are sometimes a few signatures for one malware ? Does it mean that malware has small change and that are MD5 signatures ? Today was for example submission of HTML.Phishing.Auction-1 HTML.Phishing.Auction-2 HTML.Phishing.Bank-5

[Clamav-users] .80 Compile failure (SUSE 9.0 Pro AMD64)

2004-10-21 Thread Chris Wood
In trying to compile .80 on SUSE 9.0 Pro AMD64, I get two errors. In the archives I noticed someone with the same problem back in April but he never solved it. The first error is 'make' complains about libgmp. I do have libgmp in /lib64 but not in /lib. I assume I should be able to compile a

[Clamav-users] Clamav 0.80 with daemontools ?

2004-10-21 Thread Forexys Support Center
Hii have a small problems with the 0.80 version ... he don't want start correctly..I have: 6616 ?    S  0:00  \_ supervise clamd 6707 ?    Z  0:00  |   \_ [run]  6617 ?    S  0:00  \_ supervise log 6618 ?    S  0:00  \_ /usr/bin/multilog t s100 n

Re: [Clamav-users] manipulated and encrypted zip files

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 14:37:09 +0200 Alexander Harkenthal <[EMAIL PROTECTED]> wrote: > Clamd didn't find the virus in a zip file where the zip file > information is manipulated. The global information in this zip > file about the size of the file was set to 0 Byte. We are aware of the problem and

[Clamav-users] manipulated and encrypted zip files

2004-10-21 Thread Alexander Harkenthal
Hello all, I tested my clamd version 0.80-1 which I use on my mail server with manipulated zip files as I read some warnings in some news regarding this issue. Clamd didn't find the virus in a zip file where the zip file information is manipulated. The global information in this zip file ab

[Clamav-users] Re: GDI+ bug exploit Mutations

2004-10-21 Thread Virgo Pärna
On Mon, 18 Oct 2004 15:01:46 + (UTC), Virgo Pärna wrote: > > dragon:~/soft/clamav> clamscan -r -i --no-summary clamav-0.80.tar.gz > clamav-0.80.tar.gz: Exploit.JPEG.Comment.E9 FOUND > I forget to to post immediatly - it didn'd happen anymore on Tuesday. So, the updated signatures fixed

RE: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Nigel Horne
> [mailto:[EMAIL PROTECTED] Behalf Of Trog > $ gdb clamscan > (gdb) run /path/to/message.txt > > (wait for seg fault) > > (gdb) bt Before doing that it would help to rebuild from source using the "-g" option. > -trog -Nigel ___ http://lists.clamav.ne

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Andy Fiddaman
; On Wed, 2004-10-20 at 16:33, Grant Supp wrote: ; ; > It seems to happen when scanning the same files. "Untitled Attachment" seems to cause the problem evey time. I think this attachment might be generated by Outlook 2003 when assigning a task to a user, although I'm not sure, since I don't have

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Trog
On Wed, 2004-10-20 at 20:25, Rob Dueckman wrote: > I'm running mimedefang/spamassassin/clamav on an IRIX 6.5 machine and > have found that some files cause both clamd and clamscan to core. > > Since I'm still running this combo, I can't forward the message to the > list, but it can be found at: ft

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Trog
On Wed, 2004-10-20 at 16:33, Grant Supp wrote: > It seems to happen when scanning the same files. "Untitled Attachment" seems to > cause the problem evey time. I think this attachment might be generated by Outlook > 2003 when assigning a task to a user, although I'm not sure, since I don't have

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Jason Haar
On Thu, Oct 21, 2004 at 09:38:49AM +0200, BogusÅaw Brandys wrote: > Right.Put ClamAV on front and commercial scanner on back ;-) > ClamAV do not recognize many polymorphic malwares, but today there are > not so many such malwares ;-) Too right - that describes exactly how Qmail-Scanner utilizes C

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Bogusław Brandys
Hi Niek wrote: On 10/21/2004 1:21 AM +0200, Dave P wrote: I am trying to convince my company to switch to open source where possible. It is much easier if the software has been evaluated by an independent group. Unfortunately, reviews that I could find, including GMX Systematic and Heise magazines,

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Niek
On 10/21/2004 1:21 AM +0200, Dave P wrote: I am trying to convince my company to switch to open source where possible. It is much easier if the software has been evaluated by an independent group. Unfortunately, reviews that I could find, including GMX Systematic and Heise magazines, were negativ

Re: [Clamav-users] buglet in how clamdscan reports perm issues

2004-10-21 Thread Awie
> Keep up the good work guys - ClamAV is superb!!! This means QS will continue support ClamAV, right. :D Thx & Rgds, Awie ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users