[Clamav-users] clamav-milter checks question

2006-12-12 Thread Denis Eremenko
Greetings. I would like clear some questions about clamav-milter. 1. As i understand clamav-milter checks mail whatever with clamd or libclamav, right? 2. If --external is not set for clamav-milter does it tries to connect clamd first? 3. If above true does it falls back to libclamav when clamd no

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Joe Pace
Stephen Gran wrote: Does AIX have the equivalent of linux's /proc/$pid/fd/ ? It would be nice to know if those files are open or not. Yes -- AIX 5.3 has the /proc/$pid/fd/ manifestation. Thanks! Have been stopping and restarting everything related with clam nightly to do cleanup, and nice

[Clamav-users] clamdscan help

2006-12-12 Thread Jigar Raval
Hello, I am running qmail+qmail-scanner+clamav+spamassassin on redhat linux AS 4. Clamdscan increases the load on system and when i checked up using ps command it was showing clamdscan daemon of last week also running following is the output qscand 25062 1 11 Dec12 ?01:42:58 /usr/b

Re: [Clamav-users] About Clamd

2006-12-12 Thread Laurent Besson
Le Mercredi 13 Décembre 2006 04:57, Laurent Besson a écrit : > Le Mercredi 13 Décembre 2006 04:24, ZhangFrank a écrit : > > And I want to know is there any function in ClamAV that can do some > > pre-scan when someone upload files. > > For FTP : > http://www.clamav.net/3rdparty.html#webftp > http:

Re: [Clamav-users] About Clamd

2006-12-12 Thread Laurent Besson
Le Mercredi 13 Décembre 2006 04:24, ZhangFrank a écrit : > And I want to know is there any function in ClamAV that can do some > pre-scan when someone upload files. For FTP : http://www.clamav.net/3rdparty.html#webftp ... ___ Help us build a comprehensi

[Clamav-users] About Clamd

2006-12-12 Thread ZhangFrank
Hi Dennis, Thank you for your information, If I change 3310 into 21, it will disable my ftp server? And I want to know is there any function in ClamAV that can do some pre-scan when someone upload files. In the comments of "TCPAddr" say, "By default we bind to INADDR_ANY, probably not wise.En

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Stephen Gran
On Tue, Dec 12, 2006 at 05:57:01PM -0800, Joe Pace said: > Stephen Gran wrote: > >The short term option would be to use something like tmpreaper to keep > >/tmp under control until the real problem is sorted out. I'm afraid > >I've never seen this problem before, and the permissions all look fine

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Joe Pace
Stephen Gran wrote: The short term option would be to use something like tmpreaper to keep /tmp under control until the real problem is sorted out. I'm afraid I've never seen this problem before, and the permissions all look fine in the other messages I've seen. Thank you -- this answers my q

[Clamav-users] questions about match

2006-12-12 Thread 刘健
Hello:all I just join this maillist. And I have some question about that clamAV match pattern. 1 I think clamAV don't treat a file as virus if the file only match a hex signature. Only match a MD5 signature that the file will treated as virus, isn't it? 2 There exists

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Stephen Gran
On Tue, Dec 12, 2006 at 01:32:27PM -0500, Mark Hennessy said: > I've seen some instances where clamd will sometimes leave large directories > named like clamav-[hash] or large files named like clamav-[hash] and not > clean them up after they're done with. As far as I can tell, clamav was not > sto

Re: [Clamav-users] RE: clamav-users Digest, Vol 27, Issue 9

2006-12-12 Thread Stephen Gran
On Wed, Dec 13, 2006 at 08:54:48AM +0800, ZhangFrank said: > > Hi Dennis and list, > > If I change 3310 into 21, it will disable my ftp server? > If so, is there any function in ClamAV that can do some pre-scan when > someone upload files. > In the comments of "TCPAddr" say, "By default we bi

[Clamav-users] RE: clamav-users Digest, Vol 27, Issue 9

2006-12-12 Thread ZhangFrank
Hi Dennis and list, If I change 3310 into 21, it will disable my ftp server? If so, is there any function in ClamAV that can do some pre-scan when someone upload files. In the comments of "TCPAddr" say, "By default we bind to INADDR_ANY, probably not wise. Enable the following to provide som

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Joe Pace
Stephen Gran wrote: On Tue, Dec 12, 2006 at 04:30:50PM -0800, Joe Pace said: LibClamAV Error: Can't remove temporary directory /tmp/clamav-6f0b3bbf9fc92179: Error 0 What are the permissions on /tmp ? Should have included that -- # ls -ld /tmp drwxrwxrwt 66 bin bin

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Stephen Gran
On Tue, Dec 12, 2006 at 04:30:50PM -0800, Joe Pace said: > Here's an example of one of the directories that's failing removal: > > # ls -l clamav-507d766bac9683c7 > total 24 > -rw--- 1 clamav clamav 516 Dec 12 16:21 > mixedtextportionsd7jrj > -rw--- 1 clamav clamav

Re: [Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Joe Pace
Mark Hennessy wrote: I've seen some instances where clamd will sometimes leave large directories named like clamav-[hash] or large files named like clamav-[hash] and not clean them up after they're done with. As far as I can tell, clamav was Hi Mark: I am seeing the same as well -- and this i

Re: [Clamav-users] How do I report a false positive > 2Mbytes?

2006-12-12 Thread Christoph Cordes
Mogens Kjaer wrote: > I've tried to report this on http://cgi.clamav.net/sendvirus.cgi, > however, only files < 2M are accepted. Just submit the URL. I downloaded it and we will take care of it. Thank you. -- Best regards, Christophmailto:[EMAIL PROTECTED]

Re: [Clamav-users] Re: Chronic MD5 Verification Errors

2006-12-12 Thread Edward Dam
Just to expand on this thought a bit. Shouldn't something like this be the default behaviour? To download the CVD files to a temp location, and run the MD5 there before moving it into the live database directory? This way a corrupt/bad database could be prevented from going live, and hanging the

[Clamav-users] Cruft left by clamd in temp directory

2006-12-12 Thread Mark Hennessy
I've seen some instances where clamd will sometimes leave large directories named like clamav-[hash] or large files named like clamav-[hash] and not clean them up after they're done with. As far as I can tell, clamav was not stopped/restarted during the timeframe where these were being worked on.

Re: [Clamav-users] Re: Chronic MD5 Verification Errors

2006-12-12 Thread Edward Dam
Thanks for the pointer. It's similar, but not quite the same, in that the problems I have are with the main and daily cvd files. I am not a scripter by any stretch of the imagination, but.. Is there someway I could do the same with main.cvd and daily.cvd? What I mean is, would it be possible to

Re: [Clamav-users] Offical Package for FreeBSD

2006-12-12 Thread Johnny Cho
Hello Frank and the list, On 12/12/06, ZhangFrank <[EMAIL PROTECTED]> wrote: Do we any offical installation package of clamav-0.88.6? like clamav-0.88.6.tbz If we do, where can I get it? pleaes visiti http://www.freshports.org/security/clamav/ To install the port: cd /usr/ports/securit

[Clamav-users] Re: Chronic MD5 Verification Errors

2006-12-12 Thread G.W. Haywood
Hi there, On Tue, 12 Dec 2006 Edward Dam wrote: > Intermittently, freshclam would die with an MD5 verification error Does this very recent thread help at all? Error (Cannot connect to 'localhost:3310': IO::Socket::INET: connect: Connection refused ) -- 73, Ged. __

Re: [Clamav-users] Clamav-milter & whitelist

2006-12-12 Thread Giorgio Bellussi
Gerard Seibert wrote: FreeBSD 6.1 Clamav-milter 0.88.5 Postfix-2.4-20061006 Has anyone gotten the whitelist to work with 'clamav-milter'? I am assuming that the file syntax is one entry per line. No matter what I have tried, clamav-milter insists on checking messages even when the address is in

[Clamav-users] Re: Forcing clamd to reload its database

2006-12-12 Thread Ian Abbott
On 11/12/2006 15:11, Stephen Gran wrote: On Mon, Dec 11, 2006 at 10:06:39AM -0500, Gerard Seibert said: What is the preferred method to force clamd to reload its databases? The simplest is: echo RELOAD | nc localhost 3310 I have clamd listening on a unix-domain socket and use: echo RELOAD |