Re: [Clamav-users] Re: Text of email not scanned.

2005-12-01 Thread BitFuzzy
Rob MacGregor wrote: On 02/12/05, PBR <[EMAIL PROTECTED]> wrote: Trashscan, procmail. A little too terse - how does trashscan use clamav (is it using clamd or clamscan)? clamscan If clamd, have you left the defaults on in clamd.conf? If clamav, what options is it passing?

Re: [Clamav-users] Re: Text of email not scanned.

2005-12-01 Thread Rob MacGregor
On 02/12/05, PBR <[EMAIL PROTECTED]> wrote: > > Trashscan, procmail. A little too terse - how does trashscan use clamav (is it using clamd or clamscan)? If clamd, have you left the defaults on in clamd.conf? If clamav, what options is it passing? (The short version is - the problem is most like

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread John W. Baxter
On 12/1/05 5:40 PM, "The Disc Shop" <[EMAIL PROTECTED]> wrote: > Ah okay, my bad. Misread the man clamd, thought QUIT was an option. You are far from the only one (although I was trying PING, not QUIT). Yes, it is certainly possible to read the man page correctly, but I didn't. --John (one of

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs rea

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
Matthew.van.Eerde wrote: > The Disc Shop wrote: >> [EMAIL PROTECTED] wrote: >> clamdscan --config-file=/usr/local/etc/clamd.conf abc Hmm... why is there a --config-file switch for clamdscan? I see it's in the man page... does it really work for all options? -- Matthew.van.Eerde (at) hbinc.com

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
The Disc Shop wrote: > [EMAIL PROTECTED] wrote: > clamdscan --config-file=/usr/local/etc/clamd.conf abc > /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs read access to it. > srwxrwxrwx

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: Kill all your freshclam and clamd processes. Put your .pid and socket files in a place that clamd can write. clamd starts as root, but if it needs to SIGHUP, it needs to recreate the .pid files and reinitialize the socket as clamd. I've done all this now but i

[Clamav-users] Re: Text of email not scanned.

2005-12-01 Thread PBR
Rob MacGregor <[EMAIL PROTECTED]> wrote: > > Done all this. Clamscan reports the eicar test > > string if I scan the eicar file from the command > > line, finds it if the file is an attachment. But > > not inside an email meeting all the above requirements. > > How are you integrating clamav with

Re: [Clamav-users] Please help with this error...

2005-12-01 Thread Tomasz Kojm
On Thu, 1 Dec 2005 14:27:15 -0800 Todd Lyons <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Tomasz Kojm wanted us to know: > > >It's a problem of the OP and not ClamAV that he is running an outdated > >version. The problem with AES encrypted zip archives was fix

Re: [Clamav-users] Please help with this error...

2005-12-01 Thread Todd Lyons
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Todd Lyons wanted us to know: >Tomasz Kojm wanted us to know: > >>It's a problem of the OP and not ClamAV that he is running an outdated >>version. The problem with AES encrypted zip archives was fixed more >>than five months ago in 0.86: >The daemon

Re: [Clamav-users] Please help with this error...

2005-12-01 Thread Todd Lyons
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tomasz Kojm wanted us to know: >It's a problem of the OP and not ClamAV that he is running an outdated >version. The problem with AES encrypted zip archives was fixed more >than five months ago in 0.86: The daemon says it's 0.87.1 when it starts (aft

Re: [Clamav-users] Please help with this error...

2005-12-01 Thread Tomasz Kojm
On Thu, 1 Dec 2005 21:48:21 + Stephen Gran <[EMAIL PROTECTED]> wrote: > On Thu, Dec 01, 2005 at 02:00:14PM -0600, John Tebbe said: > > Okay, I'm going about this a little backwards. In reading the > > archives, it appears there is a problem with AES128 and AES256 > > encryption. If I unzip the

Re: [Clamav-users] Please help with this error...

2005-12-01 Thread Stephen Gran
On Thu, Dec 01, 2005 at 02:00:14PM -0600, John Tebbe said: > Okay, I'm going about this a little backwards. In reading the > archives, it appears there is a problem with AES128 and AES256 > encryption. If I unzip the file and rezip it up using using standard > Zip 2 encryption, the file goes throug

RE: [Clamav-users] Please help with this error...

2005-12-01 Thread John Tebbe
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, December 01, 2005 12:33 PM To: clamav-users@lists.clamav.net Subject: RE: [Clamav-users] Please help with this error... John Tebbe wrote: > > We receive a lot of data from c

RE: [Clamav-users] Please help with this error...

2005-12-01 Thread Matthew.van.Eerde
John Tebbe wrote: > > We receive a lot of data from customers that attach ZIP files. All > has been going well until recently. A certain customer attempts to > send a zip file and it gets bounced back to them. Other customers are > not having this issue. Below is the clamd log file. Check to see

[Clamav-users] Please help with this error...

2005-12-01 Thread John Tebbe
Hi All, We receive a lot of data from customers that attach ZIP files. All has been going well until recently. A certain customer attempts to send a zip file and it gets bounced back to them. Other customers are not having this issue. Below is the clamd log file. Thu Dec 1 10:07:21 2005 ->

Re: [Clamav-users] Segmentation fault on clamscan but clamdscan OK

2005-12-01 Thread Dennis Peterson
Kenman Wong said: > Hi, > > I just installed Clamav 0.87.1 on my Linux box. This was to upgrade of > my older Clamav installation. My problem is that running "clamscan" will > always cause segmentation fault (core dump). On the other hand, clamd > and clamdscan runs fine. Is this situation possible

Re: [Clamav-users] clamav-milter not binding to sendmail

2005-12-01 Thread Hafiz Abdurehman
Thank you Jerzy Your link and your instructions were very helpful I also had to just upgrade zlib and zlib-devel packages I got it right in my first shot by equating the line (socket) from /etc/sysconfig/clamav-milter into sendmail.mc S=local:/var/run/clamav/clamav-milter.sock. restarted clam

RE: [Clamav-users] Exploit IE CVE CAN-2005-1790

2005-12-01 Thread Sander Holthas
Rick Macdougall wrote: > Elizabeth Schwartz wrote: >> On 11/23/05, Cedric Foll <[EMAIL PROTECTED]> wrote: >>> is it possible to have a clamav signature for the exploit ? >>> Proof of conecpt here: >>> http://www.computerterrorism.com/research/ie/poc.htm >> >> >> I dunno about anyone else here , b

Re: [Clamav-users] clamav-milter not binding to sendmail

2005-12-01 Thread Jerzy Sakol
From: "Hafiz Abdurehman" <[EMAIL PROTECTED]> December 01, 2005 7:17 AM Dear friends my requirement-- virus status to be shown on the header of mail messages. so I need some help on getting clamav-milter to work on sendmail.. I have done the following step 1:- Installed clam rpms clamd-0.85.1-

[Clamav-users] Segmentation fault on clamscan but clamdscan OK

2005-12-01 Thread Kenman Wong
Hi, I just installed Clamav 0.87.1 on my Linux box. This was to upgrade of my older Clamav installation. My problem is that running "clamscan" will always cause segmentation fault (core dump). On the other hand, clamd and clamdscan runs fine. Is this situation possible? During configure, mak