Damian Menscher schrieb:
I'm seeing logs like:
Intercepted virus from <[EMAIL PROTECTED]> to <[EMAIL PROTECTED]>
<[EMAIL PROTECTED]>
Seems strange to me that the invalid users would have made it past
sendmail's RCPT TO and into the AV engine. I'm guessing it's a bug.
Sometimes the invalid user
David Blank-Edelman schrieb:
Howdy-
I just wanted to pop in and provide the latest update on our saga (clamd
0.83 just stops playing nice after running for a while) with some more
interesting information like stack traces.
Last we left off I had just upped the ulimit for the clamd process from
I'm seeing logs like:
Intercepted virus from <[EMAIL PROTECTED]> to <[EMAIL PROTECTED]> <[EMAIL
PROTECTED]>
Seems strange to me that the invalid users would have made it past
sendmail's RCPT TO and into the AV engine. I'm guessing it's a bug.
Sometimes the invalid user is first, sometimes not.
Howdy-
I just wanted to pop in and provide the latest update on our saga
(clamd 0.83 just stops playing nice after running for a while) with
some more interesting information like stack traces.
Last we left off I had just upped the ulimit for the clamd process from
the default of 256 fds to 102
Mark wanted us to know:
>Yesterday, I subjected ClamAV to a very rigorous, final
>stress test. I let it scan roughly 20,000 news spool files,
>and opened an individual connection for each file (not very
>efficient, of course, but good to get massive concurrency;
>especially since I ran 5 simultane
Hello all:
We have qmail/qmail-scanner/clamav/spamassassin installed on our Linux FC3
system in a non-suidperl environment.
The error we see in the qmail-queue.log file:
clamdscan: corrup or unknown clamd scanner error or memory/resource/perms
problem - exit status 512/2
/var/spool/qmailscan/
On Mon, 07 Mar 2005 15:38:08 -0600
Troy Ayers <[EMAIL PROTECTED]> wrote:
> Anybody aware of a new mass mailing worm, possibly released in the
> last 24 hours?
http://lurker.clamav.net/message/20050307.165937.ceaee8e2.en.html
*BIG* outbreak
--
oo. Tomasz Kojm <[EMAIL PROTEC
Anybody aware of a new mass mailing worm, possibly released in the last
24 hours?
This one seems to infect winXP machines, and it relays messages their
local email server, so we're catching them quick because many(most?) of
them seem to be double-bouncing.
One customer in particular has syman
On Mon, 2005-03-07 at 19:57, Morgan Smith wrote:
> Nigel Horne wrote:
>
> >>
> >>error while loading shared libraries: /usr/local/lib/libclamav.so.1:
> >>R_PPC_REL24 relocation at 0x0ff8f650 for symbol `clearerr' out of range
> >>
> >>
> >
> >I really don't understand this. One of my main mac
On Mar 7, 2005, at 2:01 PM, Morgan Smith wrote:
Tomasz Kojm wrote:
./configure CFLAGS='-g -O2 -fPIC'
./configure CFLAGS='-g -O2 -DPIC'
Compile without additional flags.
./configure (plain with nothing else) produces the same error for me.
I'm getting ready to try a different Linux distro on my Mac
Tomasz Kojm wrote:
./configure CFLAGS='-g -O2 -fPIC'
./configure CFLAGS='-g -O2 -DPIC'
Compile without additional flags.
./configure (plain with nothing else) produces the same error for me.
--
Morgan Smith
Dutro Company
675 North 600 West
Logan, UT 84321
(435) 752-3922 ext.146
(435) 512-33
Nigel Horne wrote:
error while loading shared libraries: /usr/local/lib/libclamav.so.1:
R_PPC_REL24 relocation at 0x0ff8f650 for symbol `clearerr' out of range
I really don't understand this. One of my main machines is running YDL4.0
and I have never seen this. I don't use -mlongcall -DPIC -f
On Mon, 07 Mar 2005 12:43:25 -0700
Morgan Smith <[EMAIL PROTECTED]> wrote:
> Thanks for the guesses. I have some time on my hands and so I tried
> the following combinations which all produce the same error (except
> for the hex number):
>
> ./configure CFLAGS='-g -O2 -fPIC'
> ./configure CFLA
Trog wrote:
On Mon, 2005-03-07 at 11:50 -0700, Morgan Smith wrote:
I haven't been able to get it resolved yet. Since my last postings,
I've been swept away on other projects so I left it at v0.80 but this is
good timing because I'm now able to come back to this project. My last
attempts at
On Monday 07 Mar 2005 18:50, Morgan Smith wrote:
> I haven't been able to get it resolved yet. Since my last postings,
> I've been swept away on other projects so I left it at v0.80 but this is
> good timing because I'm now able to come back to this project. My last
> attempts at compiling wer
On Mon, 2005-03-07 at 11:50 -0700, Morgan Smith wrote:
> I haven't been able to get it resolved yet. Since my last postings,
> I've been swept away on other projects so I left it at v0.80 but this is
> good timing because I'm now able to come back to this project. My last
> attempts at compili
I haven't been able to get it resolved yet. Since my last postings,
I've been swept away on other projects so I left it at v0.80 but this is
good timing because I'm now able to come back to this project. My last
attempts at compiling were as follows.
1. I did a make uninstall for v0.80 and r
On Monday 07 March 2005 10:20 am, Dale Walsh wrote:
> > QmailMrtg7 can graph the number of viruses in an mrtg format.
> > Here is a link to our live qmailmrtg7 graphs.
> > http://mail.inter7.com/qmailmrtg/
> >
> > The software is available here:
> > http://www.inter7.com/?page=qmailmrtg7
> >
> > Ke
On Mar 07, 2005, at 10:28, Ken Jones wrote:
On Sunday 06 March 2005 11:08 am, Sam wrote:
Hi
I'm looking for something that's been written that will display the
number
of viruses/malware that Clam has stopped and pipe it to an html file
I can
provide to my customers.
I found one by Vijay (AT eric
On Sunday 06 March 2005 11:08 am, Sam wrote:
> Hi
>
> I'm looking for something that's been written that will display the number
> of viruses/malware that Clam has stopped and pipe it to an html file I can
> provide to my customers.
>
> I found one by Vijay (AT ericavijay.net) but it doesn't seem t
Trog wrote:
> Assuming I'm reading it right, I think it should be the other way
> around. Error strings look like:
>
> Reason ERROR
Ok, patched that in, thanks for pointing that out. I was basing it on
old clamdscan error string output.
--
Robert Blayzor, BOFH
INOC, LLC
rblayzor\@(inoc.net|gm
Le Lun 7 mar 09:38:30 2005, Robert Blayzor écrit:
> $err = $1 if ($r =~ /^ERROR\:(.*)/);
die "$1\n" if $r =~ /(.*) ERROR$/;
You may also remove the starting "stream: ".
___
http://lurker.clamav.net/list/clamav-users.html
On Mon, 2005-03-07 at 09:38 -0500, Robert Blayzor wrote:
> $err = $1 if ($r =~ /^ERROR\:(.*)/);
Assuming I'm reading it right, I think it should be the other way
around. Error strings look like:
Reason ERROR
-trog
signature.asc
Description: This is a digitally signed message part
___
Trog wrote:
> I hope your script handles ERROR responses correctly :-)
I'll give it a whirl, and yes, I seem to have it trapping error
conditions. (unless something changed, this always worked)
eval {
local $SIG{ALRM} = sub { die "Stream timeout"; };
alarm $sc{TIME_OUT};
while(<$csock>) {
On Mon, 2005-03-07 at 08:48 -0500, Robert Blayzor wrote:
> Ahh you are correct, that's what it does. Regardless, I know it's
> working correctly as it has worked fine for over a year now. Like I
> said, recently in 0.83 we've seen it hang up a few times. Both times
> I've been able to check the
Trog wrote:
> In that case it should be:
>
> connect 1:
> send: STREAM\n
> waitfor: PORT \d+
> connect 2: localhost:(port)
> dump message
> close connect 2:
> wait for response
> close connect 1:
>
> (notice the "close connect 2" moved up)
Ahh you are correct, that's what it does. Regardless,
On Mon, 2005-03-07 at 13:36 +, Mark wrote:
>
> Seemed like a pretty legitimate question to me. The PDF manual
> says close to nothing about SESSION/END, and certainly does not
> speak of a "pause". In fact, if "pause" is really meant, in the
> manner you quote, then this would be a horridly s
Trog wrote:
> On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> > Trog wrote:
> > > You can't send multiple commands. You *must* follow the following
> > > sequence:
> > >
> > > send: SESSION
> > > pause
> > > send: SCAN /my/file
> > > read reply
> > > send: SCAN /my/file2
> > > read re
On Mon, 2005-03-07 at 08:23 -0500, Robert Blayzor wrote:
> No, not in the same connection, one scan per connection, multiple
> connections. ie:
>
> connect 1:
> send: STREAM\n
> waitfor: PORT \d+
> connect 2: localhost:(port)
> dump message
> wait for response
> close connect 2:
> close connect
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Steve Platt
> Sent: maandag 7 maart 2005 12:00
> To: ClamAV users ML
> Subject: Re: [Clamav-users] ClamAV 0.83 - Stream scanning timeout
>
>
> [EMAIL PROTECTED] said:
> > I can also not say I u
Trog wrote:
> You can't send multiple commands. You *must* follow the following sequence:
>
> send: SESSION
> pause
> send: SCAN /my/file
> read reply
> send: SCAN /my/file2
> read reply
No, not in the same connection, one scan per connection, multiple
connections. ie:
connect 1:
send: STREAM\
Trog wrote:
> On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> > Trog wrote:
> > > You can't send multiple commands. You *must* follow the following
> > > sequence:
> > >
> > > send: SESSION
> > > pause
> > > send: SCAN /my/file
> > > read reply
> > > send: SCAN /my/file2
> > > read reply
On Monday 07 Mar 2005 12:08, Julian Mehnle wrote:
> Trog wrote:
> > send: SESSION
> > pause
>
> What's "pause" supposed to mean?
From my dictionary:
pause: interval of inaction or silence; break made in speech or
reading.
Mind you my dictionary was written before the days of the Internet.
--
On Mon, 2005-03-07 at 13:08 +0100, Julian Mehnle wrote:
> Trog wrote:
> > You can't send multiple commands. You *must* follow the following
> > sequence:
> >
> > send: SESSION
> > pause
> > send: SCAN /my/file
> > read reply
> > send: SCAN /my/file2
> > read reply
>
> What's "pause" supposed to
Trog wrote:
> You can't send multiple commands. You *must* follow the following
> sequence:
>
> send: SESSION
> pause
> send: SCAN /my/file
> read reply
> send: SCAN /my/file2
> read reply
What's "pause" supposed to mean?
___
http://lurker.clamav.net/
On Mon, 07 Feb 2005 at 15:43:49 -, Plant, Dean wrote:
> I am using Squid/Dansguardian and Clamav v0.82 and am finding the site
> www.mozilla.org/editor is getting blocked due to a reported infection. Has
> anyone else seen this?
>
> Access to the page:
>
> http://www.mozilla.org/editor/
>
>
[EMAIL PROTECTED] said:
> I can also not say I understand why ClamAV would hang on STREAM, and not on
> SCAN
Your STREAM problem may be different of course.
The messages that gave our clamd a hard time would do exactly the same for
clamscan ( "of course" ). I just wanted you to check that you
Hello Fajar A. Nugraha,
> >You can view the signatures added to each release and their aliases with:
> >http://www.clamav.net/rss/xml-rss.php?daily=XYZ
> I assume this link will also be on the RSS page (e.g. the search.php,
> which now only says "under construction")?
We are planning to compl
On Fri, 2005-03-04 at 11:59 -0500, Robert Blayzor wrote:
> Trog wrote:
> > What software are you using to do stream scanning? It is switched off by
> > default in clamav-milter 0.83
>
>
> I'm using a PERL script that is taking the messages and stream scanning
> them with clamd. It's been running
39 matches
Mail list logo
