Re: [clamav-users] clamscan doesn't have a BlockMacros option

2016-02-10 Thread Dennis Peterson
I swear when I first read the subject I thought it said BlockMorons and immediately thought it would be a good feature. :) dp On 2/10/16 1:05 AM, David Shrimpton wrote: Hi, clamscan doesn't appear to have an option equivalent to the OLE2BlockMacros in clamd.conf for clamdscan. clamdscan will

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Dennis Peterson
Clamd is for on-demand scanning and purpose built for email scanning. It runs as an unprivileged user which makes it awkward for scanning arbitrary files. Clamscan is for user initiated or scheduled scanning of arbitrary files, and can be run as any system user. Clamscan is undesirable as an on-

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Brad Scalio
Unfortunately there are certain standards that information systems have to adhere to regardless of the logic under specific deployments (I.E. FIPS, FISMA). Considering there are other technical controls that would impact operations much more significantly than running antivirus on a Linux system,

Re: [clamav-users] ClamAV automation question

2016-02-10 Thread Steven Morgan
Edwin, Sounds like on-access scanning with clamd may be useful in your case. You will need ClamAV 0.99. Here is some additional info: http://blog.clamav.net/2015/09/clamav-099b2-on-access-scanning-now.html Steve On Wed, Feb 10, 2016 at 3:58 AM, Edwin Nguku wrote: > Hi, what commands can I

[clamav-users] DNS queries to daily.xxxxx.xx.x.x.XXXXXXXX.ping.clamav.net

2016-02-10 Thread Kevin Kretz
Hi list, Our clamav is part of our email system that lives on a part of our network that has as controlled as possible access (both in to and out from). We have Clam using an HTTP proxy for its updates which seems to be working well. We notice occasional DNS queries in the format listed in th

Re: [clamav-users] ScanOLE2 yes disables macro virus detection

2016-02-10 Thread David Shrimpton
On Tue, 9 Feb 2016, Steven Morgan wrote: > David, > > I've opened https://bugzilla.clamav.net/show_bug.cgi?id=11498 to > investigate and track the issue. Plz sign up for an account at > https://bugzilla.clamav.net and send me the user id and I will CC you on > the bug. Once that is done, I will n

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Gene Heskett
On Wednesday 10 February 2016 10:22:44 Kris Deugau wrote: > Gene Heskett wrote: > > But, I do wish that clamd would send me a substitute email advising > > that it has stashed a suspect incoming email into the > > mailfile /var/spool/mail/virii. I try to look that file over for > > FP's, but quic

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Kris Deugau
Gene Heskett wrote: > But, I do wish that clamd would send me a substitute email advising that > it has stashed a suspect incoming email into the > mailfile /var/spool/mail/virii. I try to look that file over for FP's, > but quickly get lost in the visual garbage because its probably a zip'd >

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Gene Heskett
On Wednesday 10 February 2016 05:29:19 Brad Scalio wrote: > I've seen a lot of fodder on clamd vs clamscan, running 0.99 on > RHEL6.7 exit/entry points ... While it's easy enough to use clamscan > via cron, is there any good stepwise SOP on getting clamd to work > permission wise to scan all files

Re: [clamav-users] Clamd vs clamscan

2016-02-10 Thread Matus UHLAR - fantomas
On 10.02.16 05:29, Brad Scalio wrote: I've seen a lot of fodder on clamd vs clamscan, running 0.99 on RHEL6.7 exit/entry points ... While it's easy enough to use clamscan via cron, is there any good stepwise SOP on getting clamd to work permission wise to scan all filesystem? For the case of an

[clamav-users] Clamd vs clamscan

2016-02-10 Thread Brad Scalio
I've seen a lot of fodder on clamd vs clamscan, running 0.99 on RHEL6.7 exit/entry points ... While it's easy enough to use clamscan via cron, is there any good stepwise SOP on getting clamd to work permission wise to scan all filesystem? I like the ability to have it all controlled via the daemon

Re: [clamav-users] clamscan doesn't have a BlockMacros option

2016-02-10 Thread Steve Basford
On Wed, February 10, 2016 9:05 am, David Shrimpton wrote: > Hi, > > > clamscan doesn't appear to have an option equivalent to the > OLE2BlockMacros in clamd.conf for clamdscan. > Hi David, Just for info... I've already logged a bugzilla entry to add that option to Clamscan here: https://bugzill

[clamav-users] clamscan doesn't have a BlockMacros option

2016-02-10 Thread David Shrimpton
Hi, clamscan doesn't appear to have an option equivalent to the OLE2BlockMacros in clamd.conf for clamdscan. clamdscan will report Heuristics.OLE2.ContainsMacros FOUND for a file with macros if OLE2BlockMacros is yes but clamscan doesn't appear to be able to do this. clamscan does however have

[clamav-users] ClamAV automation question

2016-02-10 Thread Edwin Nguku
Hi, what commands can I run as root to configure ClamAV to carry out real time checks and block malware from being uploaded on to the server? In which case should a malicious file be detected, it should be blocked/quarantined and an email sent to the user regarding the event. Kindly assist on how