Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Ryan Goode
A few minutes ago it all started working again. Thanks! -Original Message- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of Noel Jones Sent: Thursday, February 14, 2013 2:52 PM To: clamav-users@lists.clamav.net Subject: Re: [clamav-us

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Noel Jones
Two choices: - wait. It will eventually sort itself out. - remove mirrors.dat and run freshclam manually. Might have to do this more than once. -- Noel Jones On 2/14/2013 12:59 PM, Ryan Goode wrote: > Is that the only solution? We have to hit a ton of servers as none of our > servers us

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Daniel McDonald
On 2/14/13 12:59 PM, "Ryan Goode" wrote: > Is that the only solution? We have to hit a ton of servers as none of our > servers using clam have been able to update for a few hours. I'm seeing success with daily version 16683 > > -Original Message- > From: clamav-users-boun...@lists.cl

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Ryan Goode
Is that the only solution? We have to hit a ton of servers as none of our servers using clam have been able to update for a few hours. -Original Message- From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users-boun...@lists.clamav.net] On Behalf Of Dan Schwartz Sent: Thursday, F

Re: [clamav-users] Does Filesize(HDB) or PESectionSize(MDB) of executables play any role in virus pattern matching?

2013-02-14 Thread Kaushik Vaidyanathan
Hi Alain Thanks Alain. Is the "FileSize" or "PESectionSize" used as a pre-processing(or filtering) step while scanning files? What I mean is does ClamAV use the size of the file to filter out all virus patterns that dont have the same filesize as that of the file under inspection? After finding

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Joel Esler
In any case. This signature was dropped a couple days ago, and beyond that, users can ignore it on their end. -- Joel Esler Senior Research Engineer, VRT Open Source Community Manager On Thursday, February 14, 2013 at 11:28 AM, Daniel McDonald wrote: > On 2/14/13 10:13 AM, "Matus UHLAR - f

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Dan Schwartz
I had a similar problem. I found if I removed the old main.cld and daily.cvd, and then ran freshclam, it re-downloaded everything and seems to be working fine. My main.cld was from 2011 (pretty old). Dan On Thu, Feb 14, 2013 at 11:00 AM, Clayton Keller wrote: > Within the past hour we have st

Re: [clamav-users] Does Filesize(HDB) or PESectionSize(MDB) of executables play any role in virus pattern matching?

2013-02-14 Thread Alain Zidouemba
On Wed, Feb 13, 2013 at 9:32 PM, Kaushik Vaidyanathan < kvaid...@andrew.cmu.edu> wrote: > Hi > > Do the FileSize field in a HDB signature serve any purpose during pattern > matching, or pattern matching relies only on the MD5 checksum? > > File size serves the purpose of making sure we are looking

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Clayton Keller
On 02/14/2013 10:31 AM, Shawn Webb wrote: On Thu, Feb 14, 2013 at 11:00 AM, Clayton Keller wrote: Within the past hour we have started seeing the following errors reported when running freshclam: ERROR: getpatch: Can't download daily-16682.cdiff from db.us.clamav.net ERROR: Can't download dail

Re: [clamav-users] Database Mirror Issues

2013-02-14 Thread Shawn Webb
On Thu, Feb 14, 2013 at 11:00 AM, Clayton Keller wrote: > Within the past hour we have started seeing the following errors reported > when running freshclam: > > ERROR: getpatch: Can't download daily-16682.cdiff from db.us.clamav.net > ERROR: Can't download daily.cvd from db.us.clamav.net > ERROR:

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Daniel McDonald
On 2/14/13 10:13 AM, "Matus UHLAR - fantomas" wrote: >>> On 13.02.13 14:59, Jim Preston wrote: Unless I am mistaken, that is the point of this thread. The fact that if you want non-apple approved applications, you need to jailbreak the phone and hence should Envais0n be considered

[clamav-users] Database Mirror Issues

2013-02-14 Thread Clayton Keller
Within the past hour we have started seeing the following errors reported when running freshclam: ERROR: getpatch: Can't download daily-16682.cdiff from db.us.clamav.net ERROR: Can't download daily.cvd from db.us.clamav.net ERROR: getpatch: Can't download daily-16682.cdiff from database.clamav.n

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Joel Esler
I'll defer that decision to Alain, or the person that wrote the detection. -- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire On Thursday, February 14, 2013 at 11:13 AM, Matus UHLAR - fantomas wrote: > On 14.02.13 10:57, Joel Esler wrote: > > More info on the Ja

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Matus UHLAR - fantomas
On 14.02.13 10:57, Joel Esler wrote: More info on the Jailbreak. Good read: http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html And what do you think about the PUA/malware clasification of it? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ W

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Matus UHLAR - fantomas
On 13.02.13 14:59, Jim Preston wrote: Unless I am mistaken, that is the point of this thread. The fact that if you want non-apple approved applications, you need to jailbreak the phone and hence should Envais0n be considered malware since it exploits IOS flaws to allow jailbreaking. On 2/14/13

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Benny Pedersen
Daniel McDonald skrev den 14-02-2013 14:17: But for the majority of us, It's not just potentially unwanted, it is simply unwanted. If I had wanted an open phone, I would have bought an Android. if you did you would know that its not more open then an iphone, but it have a setting to let use

Re: [clamav-users] daily-16682.cdiff not found on remote server

2013-02-14 Thread Shawn Webb
On Thu, Feb 14, 2013 at 10:59 AM, Matthias Egger wrote: > Hello > > Since about two hours we get the following Errors while updating with > freshclam: > > ClamAV update process started at Thu Feb 14 16:51:42 2013 > main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: > sven)

[clamav-users] daily-16682.cdiff not found on remote server

2013-02-14 Thread Matthias Egger
Hello Since about two hours we get the following Errors while updating with freshclam: ClamAV update process started at Thu Feb 14 16:51:42 2013 main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven) WARNING: getpatch: Can't download daily-16682.cdiff from db.de.clam

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Joel Esler
More info on the Jailbreak. Good read: http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html -- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire On Thursday, February 14, 2013 at 8:17 AM, Daniel McDonald wrote: > On 2/14/13 2:18 AM, "M

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Daniel McDonald
On 2/14/13 2:18 AM, "Matus UHLAR - fantomas" wrote: > > On 13.02.13 14:59, Jim Preston wrote: >> Unless I am mistaken, that is the point of this thread. The fact that >> if you want non-apple approved applications, you need to jailbreak >> the phone and hence should Envais0n be considered malware

Re: [clamav-users] False Positive - Osx.Exploit.Iosjailbreak

2013-02-14 Thread Matus UHLAR - fantomas
On 02/13/2013 07:36 AM, Joel Esler wrote: Apple doesn't block everything but what they have tested. What does that mean? On Wednesday, February 13, 2013 at 10:02 AM, Jim Preston wrote: Basically it means that you have get your applications from the App Store and all programs have to be approv