Re: [clamav-users] ClamAV 1.4.0 release candidate now available!

Hi, No, it's not an issue if it's not present. We added it to the output so that when people are blocked, and ask us why, it should already be in the output, and save us the step of asking for it. Thanks, Andy From: clamav-users on behalf of Ralf Hildebrandt

Re: [clamav-users] clamd: Is chunked scanning possible/sensible for files > 2Gbyte?

Hi Ray, Sorry, chunking won't work. Clam treats files differently based on file type, and signatures are written based on looking at the whole file. Thanks, Andy From: clamav-users on behalf of Ray Sent: Thursday, August 31, 2023 2:41 AM To: ClamAV users ML

Re: [clamav-users] Any hard size limit for scanned files?

Hi, The max file size is 2GByte. If you would like to be notified when a file is over the limit, you should use 'AlertExceedsMax'. We are currently not working on increasing the file size limit. Thanks, Andy From: clamav-users on behalf of Andrew C Aitchison

Re: [clamav-users] Build ClamAV Statically including dependencies

Hi Steve, If you install mussels, you should be able to build with msl build clamav_deps -t host-static msl build clamav -t host-static Does that not work for you? Thanks, Andy From: clamav-users on behalf of Steve Foster via clamav-users Sent: Tuesday

Re: [clamav-users] Funny --include-dir behaviour

o" \ > --database="/var/lib/clamav" \ > --log="/var/log/clamav/clamscan.log" > #--move="/etc/clamav/virusevent.d/Mail" what is your current directory? Since none is specified, the current directory is chosen,

Re: [clamav-users] about ”Can't allocate memory ERROR”

.v20070510.jar Thanks, Andy From: clamav-users on behalf of Tsutomu Oyamada Sent: Wednesday, February 1, 2023 8:36 AM To: ClamAV users ML Subject: [clamav-users] about ”Can't allocate memory ERROR” Hi all, We use the services of clamd to scan files. The version

Re: [clamav-users] [EXTERNAL] Re: Off Line Signature updates.

in the documentation<https://docs.clamav.net/> section. If your network is segmented or the end hosts are unable to reach the internet, you should investigate setting up a private local mirror<https://docs.clamav.net/appendix/CvdPrivateMirror.html> using the cvdupdate tool. Kind Regards Andy N

[clamav-users] Off Line Signature updates.

Hi CLAMAV, We only operate an air gapped system but still require anti-malware. Do you provide any options (free or paid) that would enable us to download signature updates without the use of private local mirrors running cdvupdate or freshclam? Many thanks Andy NATS Internal

Re: [clamav-users] linux.cvd database question

The linux.cvd is kept up to date with linux-specific signatures, but obviously doesn't have the coverage that the rest of the signature databases have. Thanks, Andy From: clamav-users on behalf of Jimmy F via clamav-users Sent: Sunday, December 11, 2022 11:10

Re: [clamav-users] Memory Allocation error, clamd stop running

ticrap upload\ChromeSetup.exe: Can't allocate memory ERROR The error happens with any file, several times during a normal scanning in any folder. Is that a normal error reporting? Thanks you Jorge El vie, 9 dic 2022 a las 18:08, Andy Ragusa (aragusa) via clamav-users (mailto:clamav

Re: [clamav-users] Memory Allocation error, clamd stop running

can try to reproduce this? Thanks, Andy From: clamav-users on behalf of Jorge Elissalde via clamav-users Sent: Thursday, December 8, 2022 6:20 AM To: ClamAV users ML Cc: Jorge Elissalde Subject: Re: [clamav-users] Memory Allocation error, clamd stop running Hi

Re: [clamav-users] Memory Allocation error, clamd stop running

Hi Jorge, Is it a particular file that is being scanned when this happens? Could you please send clamd's logs to help determine what is going on? Thanks, Andy From: clamav-users on behalf of Jorge Elissalde via clamav-users Sent: Wednesday, December 7, 2022 3

Re: [clamav-users] PUA - Category List, invalid URL in config sample! Packer Category?

I think having a working URL is better than a non-working. Thank you! Of course, the information on that page is just as outdated (hypothetical) as the previous link had been. According to the information supplied 2 years ago, here a list of actually used signature prefixes:

Re: [clamav-users] PUA - Category List, invalid URL in config sample! Packer Category?

, November 23, 2022 8:49 AM To: ClamAV users ML Cc: Andy Schmidt ; cla...@jubileegroup.co.uk Subject: Re: [clamav-users] PUA - Category List, invalid URL in config sample! Packer Category? I cleaned up the code and prepared a PR to assist. Currently in draft and comments are welcome. The code seems

Re: [clamav-users] PUA - Category List, invalid URL in config sample! Packer Category?

the benefit of this product. Best Regards Andy -Original Message- From: G.W. Haywood Try replacing the function cli_chkpua() in .../libclamav/readdb.c with... ... No promises, but it's loaded the DB OK here. Please feel free to correct mistakes in this an

[clamav-users] PUA - Category List, invalid URL in config sample! Packer Category?

very ClamAV user is also a C++ programmer, which I am not.) Best Regards, Andy -Original Message- From: Arnaud Jacques Sent: Friday, November 18, 2022 11:33 AM To: ClamAV users ML Subject: Re: [clamav-users] PUA - Category List, invalid URL in config sample! Packer Categor

[clamav-users] PUA - Category List, invalid URL in config sample! Packer Category?

Problem 1 - Link in Config Sample is 404! According to the current clamd.conf.sample: # See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for the complete list of PUA categories. Problem 2 - What PUA Category covers "Win.Packer.Borland." ?

Re: [clamav-users] ClamAV 0.103.0 release candidate - systemd service start fails

to the parent. I am currently working on a patch to have the parent drop privileges so that it can be signaled by the child. Thanks, Andy From: clamav-users on behalf of Michael Orlitzky via clamav-users Sent: Friday, August 21, 2020 12:20 PM To: clamav-users

Re: [clamav-users] Remote Shutdown command

, Andy From: clamav-users on behalf of Kevin Faber via clamav-users Sent: Tuesday, July 21, 2020 12:44 PM To: clamav-users@lists.clamav.net Cc: Kevin Faber Subject: Re: [clamav-users] Remote Shutdown command Hello, any update on this issue? From: Kevin Faber

[clamav-users] PUA Categories vs. reported name?

Here is the official list of PUA categories: https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md So WHICH of these categories is then: PUA.Win.Downloader.Aiis-6803892-0 ___ clamav-users mailing list clamav-users@lists.clamav.net

Re: [clamav-users] --quiet and "Connecting via proxy" message

Hi Sergey, Thank you for letting us know. I created an internal ticket for this issue, but I am not sure when it will be scheduled. Thanks, Andy From: clamav-users on behalf of Sergey Sent: Wednesday, June 17, 2020 2:09 AM To: ClamAV users ML Subject: Re

Re: [clamav-users] scanning petabyte-size filesystem

At LEAST for the Windows build of ClamAV there are 2 GB file size limitations (and bugs) due to use of old 32-bit library functions: https://bugzilla.clamav.net/show_bug.cgi?id=12251 I have not encountered the same problem with TB volumes though. -Original Message- From: Kazunori Ohki

Re: [clamav-users] Digital signature verification when updating the virus database

Hi Artem, Yes, freshclam does verify the signatures, and you can verify with sigtool --info. Thanks, Andy From: clamav-users on behalf of Artem via clamav-users Sent: Wednesday, June 10, 2020 10:02 AM To: clamav-users@lists.clamav.net Cc: Artem Subject

Re: [clamav-users] Whitelist databases/File whitelist - format?

. Thanks, Andy From: clamav-users on behalf of Pascal De Meerleer via clamav-users Sent: Thursday, May 7, 2020 7:44 AM To: ClamAV users ML Cc: Pascal De Meerleer ; G.W. Haywood Subject: Re: [clamav-users] Whitelist databases/File whitelist - format? Public

[clamav-users] Html.Malware.Agent-7380889-0 false positive on Apache files?

the internet), but haven’t seen any traffic on this listserv and Google hasn’t helped much. Anybody have any similar hits? -- Andy Keller Director, Information Security and Compliance | CISSP, CCSK, Security+ | Decision Lens <http://www.decisionlens.com/>andykel...@decisionlens.com<mailt

Re: [clamav-users] Are signatures for Windows only?

‎Hi Clayton,Use lowercase for the filename or go to www.clamav.net click on Download, scroll down to the Windows packages and select the one you require.Regards,Andy

[clamav-users] Signatures once again 2 days old

This has become a regular occurrence - but since no one else has mentioned it... according to the automated alerts I am receiving for MY server, the signature updating seems to be stuck again. The "up to date daily.cld" is now 40 hours old. Sun Mar 18 11:42:02 2018 -> ClamAV update process

Re: [clamav-users] Official Windows Build of ClamAV 0.99.4 issues bogus version warning

> Subject: Re: [clamav-users] Official Windows Buld of ClamAV 0.99.4 issues bogus version warning Kees, Andy, You're correct that it is legitimate mis-behavior. This is my fault. I just sent an explanation as a response to the 0.99.4 blog announcement thread explaining the source of the i

Re: [clamav-users] Official Windows Buld of ClamAV 0.99.4 issues bogus version warning

mention of a misbehavior by the original reporter, while I had been sitting back and let someone else take the heat for daring to suggest that this message clearly was not "as intended". Best Regards Andy -Original Message- From: Kees Theunissen <c.j.theunis...@differ.nl>

Re: [clamav-users] ClamAVR blog: ClamAV 0.99.4 has been released!

Nah, Brian, in this case it's actually a bug, albeit a "cosmetic" one. I have been getting the same misleading error message on every system ever since I upgraded to 0.99.4 - so I suspect many, if not all others, have too: Thu Mar 08 11:46:31 2018 -> WARNING: Local version: clamav-0.99.4

[clamav-users] Daily.cld is >25h old (15 NOV 2017 16:51 EST)

Is 24047 truly the latest - no updates in more than a day? Thu Nov 16 18:29:11 2017 -> freshclam daemon 0.99.2 (OS: win32, ARCH: x86_64, CPU: x86_64) Thu Nov 16 18:29:11 2017 -> ClamAV update process started at Thu Nov 16 18:29:11 2017 Thu Nov 16 18:29:12 2017 -> main.cld is up to date

[clamav-users] FreshClam Mirrors - daily.cld stuck at version: 24010, safebrowsing cdiff missing.

Daily.cld is > 24 hours old (11/2 @ 8:19 AM EDT), Safebrowsing.cld is almost a day old (11/2 @ 1:50 PM EDT). Since then, Freshclam claims that daily.cld is "up to date" (sample log from an hour ago), and neither the US nor the DE mirrors can get to download safebrowsing-46607.cdiff Fri Nov 03

[clamav-users] "ERROR: Malformed database" for local.ign2 with Windows Newlines

I just confirmed that the Windows builds of ClamAV 0.99.2 will fail to start ClamD if a "local.ign2" file exists in the database folder that (naturally) was created under Windows, using the standard Notepad applet. The default newline sequence for Windows is CR+LF. The default newline sequence

Re: [clamav-users] clamav-0.99.2 Installation

therversions Best Regards Andy ___ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://ww

Re: [clamav-users] Using paypal-communication.com for link tracking purposes

>> The domain https://epl.paypal-communication.com is used by Paypal for link tracking purposes in their emails. << There is nothing wrong with PayPal using the domain (or subdomains of) paypal-communication.com as links in their emails. Their HTML emails cannot disguise that link by showing a

Re: [clamav-users] Apparently legitimate Paypal email disguises domain name in links - thus identified as likely phishing

>> The text shown to the user is www.paypal.com but the actual URL being used is https://epl.paypal-communication.com << Agreed - if any email displays a DIFFERENT domain name to the user than the domain name used in the link, then this IS solid reason to unconditionally block an email. It is

Re: [clamav-users] DNS Caching Problem AGAIN with current.cvd.clamav.net?

Hi Al, >> I am not understanding your point here. Where are you seeing an indication that the database had been updated at the time you wrote? The first indication of an update was an email announcing daily 23390 at 8:30am PDT << Good point. I may have incorrectly assumed that no updates for

[clamav-users] DNS Caching Problem AGAIN with current.cvd.clamav.net?

The same problem had been "fixed" a few weeks ago: http://network-tools.com/nslook/Default.asp?domain=current.cvd.clamav.net =16=67.222.132.213=1=53=5000=12=7 current.cvd.clamav.net

[clamav-users] Incorporate Sanesecurity's feed

>> We already distribute some third party feeds into the official database, we have a program for that which can be found on our website. We would love to incorporate Sanesecurity's feed, all they have to do is give us the okay to do it. << Gosh that would be marvelous! I'm quite interested

[clamav-users] No Signature updates for 30 hours?

Hi, I noticed that the list archive had no more messages since 4/28. And according to the FreshClam log, the last signature update is 30 hours old (times below are EDT). Did they finally arrest the last malware author? Sun Apr 30 02:01:06 2017 -> Downloading daily-23343.cdiff [100%] Sun Apr

Re: [clamav-users] Java.Malware.Agent-1756221 false positive still detected

Will do, thanks. Sorry for the clutter. -- Andy Keller Cloud Security Manager | CISSP, CCSK, Security+ | Decision Lens <http://www.decisionlens.com/>andykel...@decisionlens.com o: (703) 399-3186 c: (419) 356-3419 On 10/12/16, 11:33 AM, "clamav-users on behalf of Mark Allan"

[clamav-users] Java.Malware.Agent-1756221 false positive still detected

We’ve got the netty-all.jar that is the subject of a recent false positive and subsequent fix: https://www.clamxav.com/BB/viewtopic.php?f=1=4761=b5e35899ad6c2e6a132aa87031dc504c However, despite updating our definitions via freshclam, this is still hitting on that file. Has anyone else

[clamav-users] Suggestion: Need option to "Block Skipped Files" and Scan Summary to indicate "Skipped files"

file more carefully. b)An appropriate line in the SCAN SUMMARY, e.g.: --- SCAN SUMMARY --- Infected files: 0 Skipped files: 1 Time: 1.610 sec (0 m 1 s) Thank for giving this suggestion your consideration. Best Regards Andy Schmidt

[clamav-users] Why has clam started updating itself every 3 hours?

This is new behavior, as far as I know. We’ve not seen this sort of thing before. I’m noticing (via OSSEC) that our ClamAV deployments are updating themselves every 3 hours. This is far in excess of the cron we set up to run Freshclam. Any idea what could be causing this?

Re: [clamav-users] [FWD: Re: Some questions about setting up ClamAV]

for all the help! Original Message Subject: Re: [clamav-users] Some questions about setting up ClamAV From: Simon Hobson li...@thehobsons.co.uk Date: Wed, January 25, 2012 10:35 am To: ClamAV users ML clamav-users@lists.clamav.net Andy Newby wrote: We're using ClamAV

[clamav-users] Some questions about setting up ClamAV

day! -- Andy Newby a...@ultranerds.co.uk ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

[clamav-users] ClamAV 0.97 - configure wants zlib/zlib-devel packages, not in repository

in the FAQ and list archive] ANDY - Salt Lake, UT US ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

Re: [Clamav-users] YUM Clama

is currently stuck on 0.95.3. Andy ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

Re: [Clamav-users] YUM Clama

On 19/04/2010 21:34, Jim Preston wrote: On Apr 19, 2010, at 12:26 PM, Andy Loates wrote: [Snip] From previous experiences going back to FC3 the Clamav package is only updated by the Fedora Team when there is a new release ie FC13. The FC12 package is currently stuck on 0.95.3. Andy

Re: [Clamav-users] ClamAV 0.96, Solaris 10, and max open fds

On Tue, 13 Apr 2010, scott.larn...@ed.ac.uk wrote: ; Hello, ; ; I tested ClamAV 0.96 on a relatively recent Solaris 10 / i86pc machine and all ; was well. Bringing it up on a production machine running a somewhat older ; version of Solaris 10 (also i86pc), clamd gives the warning: ; ; WARNING:

[Clamav-users] Freshclam permissions error

). $ ps -Af | grep clamd amavis 30448 1 0 16:00 ?00:00:04 clamd andy 31044 26453 0 16:12 pts/100:00:00 grep clamd $ ls -l /var/log/clamav total 20 -rw-r--r-- 1 amavis clamav 1951 Apr 7 16:11 clamd.log -rw-r- 1 amavis clamav 9529 Apr 7 04:02 clamd.log.1 -rw-r--r-- 1 amavis

Re: [Clamav-users] Freshclam permissions error

wrote: Andy Theuninck wrote: I'm getting an error that I don't understand. Here's the brief summary, followed by the wordier explanation: Brief: $ freshclam ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!). ERROR: Problem with internal logger

Re: [Clamav-users] please remove - 27 emails and counting

I believe (and this email is probably no exception) but Gmail and others default to top posting. This mail is me just hitting reply, and typing where the cursor defaults to. Won't happen again, but just FYI. On Fri, Feb 20, 2009 at 4:25 PM, Tomasz Papszun tomek-clam-us...@lodz.tpsa.pl wrote:

Re: [Clamav-users] How to test ClamAV

You'll need to find a nastie that your local/server AV don't detect, but ClamAV does. Or make an exception for a file extention... rename eicar.txt to eicar.z43 (something random) and make sure your server and local av will ignore that file extention. On Fri, Feb 6, 2009 at 10:45 AM, Alex

Re: [Clamav-users] Using clamav on internet gateway

Another is SafeSquid, which now does not require Squid itself to be installed and or running if it is installed. http://www.howtoforge.com/gateway-level-virus-security-clamav-safesquid-proxySafeSquid has windows and *nix support. I believe Snort can even use ClamAV

Re: [Clamav-users] How to test ClamAV?

EICAR http://www.eicar.org/anti_virus_test_file.htm VX heavens http://vx.netlux.org/vl.php On Fri, Dec 5, 2008 at 6:14 PM, Brandon Perry [EMAIL PROTECTED] wrote: When you compile ClamAV, use --enable-check (iirc) and make sure you have check installed. Then, when it is done compiling, you

Re: [Clamav-users] 7zip detection broken in 0.94?

now. Anyway, I guess I agree with the feature request, 7z support similar to NetFamr's in their windows port would be awesome! On Fri, Oct 24, 2008 at 2:40 AM, Tomasz Kojm [EMAIL PROTECTED] wrote: On Fri, 24 Oct 2008 00:31:39 -0400 Andy [EMAIL PROTECTED] wrote: Is 7z not supported any longer

[Clamav-users] List

Is this list still alive? Last post received on 7/4/08. No monthly email reminder today. Checked website, my user options for this list all seems ok. Hope to hear from someone! Andy Loates ___ Help us build a comprehensive ClamAV guide: visit http

[Clamav-users] freshclam GMP3 vs GMP4

the option of installing V3 from ports. I re-built clamav from source and installed, but still the same error. Does anyone know if freshclam can work with GMP4 or not and if so how? thanks for any info, cheers Andy. ___ Help us build a comprehensive

Re: [Clamav-users] clamavd hangs frequently

Hi Joern, I cant help u with the clam prob, but I can save u writing ur own script to restart clamd. Do a search on sourceforge for psmon, its pretty handy (tho I modified it a little to make it more useful for what I needed), cheers Andy. ___ Help

Re: [Clamav-users] freshclam GMP3 vs GMP4

Have you tried installing ClamAV from ports, so that it handles this for you? Erm, actually no! :P It had originally been installed from source, so thats how I did the upgrade. But just tried installing via ports instead and no more freshclam error, so thanks! cheers Andy

[Clamav-users] Sanesecurity mirror hosed

http://mirror.kozstyle.org is serving up This Account Has Been Suspended. Perhaps we could change clamd to gracefully ignore malformed DBs with an error message, rather than exiting and filling up mail queues? Thanks, Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972

Re: [Clamav-users] Sanesecurity mirror hosed

On second thought, it turns out I have an old updating script which doesn't verify the DB validity before installing. Mea culpa. Andy On Thu, 20 Dec 2007, Andy Dills wrote: http://mirror.kozstyle.org is serving up This Account Has Been Suspended. Perhaps we could change clamd

Re: [Clamav-users] signature names

On Wed, 12 Sep 2007, Karsten Bräckelmann wrote: ; On Wed, 2007-09-12 at 07:28 -0700, John Rudd wrote: ; (to the developers, not in answer to Burnie) ; ; See, the current name scheme needs to be fixed. And no one responded at ; all to my proposed scheme from a month or two ago. ; ;

Re: [Clamav-users] speeding up clamav

; Res wrote: ; On Sun, 9 Sep 2007, Dennis Peterson wrote: ; ; F-PROT Antivirus for Solaris Mail Servers ; Number of Users Annual license fee ; 1-10US$ 130 ; 11-24 US$ 250 ; 25-49 US$ 399 ; 50-99 US$ 499 ; 100-199

Re: [Clamav-users] What's broken?

connect attempt (bb#413), patch from Andy Fiddaman ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] 0.90.1 - clamd died on Solaris 9

? Andy ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] 0.90.1 - clamd died on Solaris 9

On Thu, 8 Mar 2007, Alex Moore wrote: ; On Thu, 8 Mar 2007 16:02:40 + (GMT) ; Andy Fiddaman [EMAIL PROTECTED] wrote: ; ; ; On Thu, 8 Mar 2007, Didi Rieder wrote: ; ; Lucky you, maybe to low message volume ; ; We have a several Solaris 10 servers running 0.90.1, each processing

Re: [Clamav-users] problem compiling ver .90 on Solaris 9 and 10

On Fri, 23 Feb 2007, Jerry K wrote: ; Text relocation remains referenced ; against symbol offset in file ; unknown 0x4d4 ; /usr/local/ssl/lib/libssl.a(s3_lib.o) ; unknown 0x4d8 ; fopen64

Re: [Clamav-users] res_close on Solaris 8

although it is present in Solaris 9 10. Try changing res_close to res_nclose in clamav-milter.c (4 places). res_close() is defined as below in BIND 8 and above. void res_close(void) { res_nclose(_res); } Andy ___ Help us build a comprehensive

[Clamav-users] libclamav saying DB is old, can't detect virus

now other virii might be getting through :( Have I missed something blatently obvious? Thanks, Andy. mx tmp # clamscan --debug postcard.exe LibClamAV debug: Loading databases from /var/lib/clamav LibClamAV debug: Loading /var/lib/clamav/daily.cvd LibClamAV debug: in cli_cvdload() LibClamAV

Re: [Clamav-users] libclamav saying DB is old, can't detect virus

Andy ([EMAIL PROTECTED]) wrote: Hey, I'm having some trouble with a virus that got past clamav. Log is pasted below, but I seem to have two problems: 1) libclamav is saying my database is old when it isn't update... I didn't want to stop clamav on a production system but on comparing

Re: [Clamav-users] libclamav saying DB is old, can't detect virus

rejected with prejudice. Oh I agree and that is actually in place (via simscan). The .exe was removed from a .zip file for debugging my problem. So the .exe file never changed from one scan to the next, yet changing the definitions somehow made the scanner pick up the virus. Andy

[Clamav-users] Packages for Solaris 10 64-bit available.

or the ClamAV team! Andy PS: Could a member of the ClamAV team update the Binary Packages page on clamav.net to include Solaris 10 in the link to this site? ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http

Re: [Clamav-users] Web Site Authentication Prior to VirusDB download

On Thu, 2 Feb 2006, [EMAIL PROTECTED] wrote: ; The company I work for has implemented a firewall that only allows certain ; activity through it. I have requested that the user agent string ; clamav/* be allowed to communicate with the internet. The request has ; been refused because of security

Re: [Clamav-users] oops, ClamAV passing virus that Norton desktop detects?

On Sat, 21 Jan 2006, Len Conrad wrote: ; had. The f-prot-good vs clamav-bad difference was clear and quick. But ; we're sure where the problem is. We have assumed clam is a good as f-prot. I run multiple AV scanners in parallel here including ClamAV and F-Prot. It's extremely rare that F-Prot

Re: [Clamav-users] Virus not detected by clamav

On Mon, 19 Dec 2005, Hamilton Vera wrote: ; Since November, I noticed that clamav 87.1 does not recognize the following ; virus. ; ; www.i2.com.br/~hamilton/reg_pass.zip ; ; So I posted it in http://cgi.clamav.net/sendvirus.cgi, but I got no answer ; ; NOD32 detects it as Win32/Sober.Y

Re: [Clamav-users] my ClamAV protected acct fails testvirus.org eicar test

On Thu, 27 Oct 2005, Roger Rustad wrote: ; ClamAV aficionados: ; ; I just recently bought an account on webhostingbuzz.com. Curious as to how ; well the domains were protected against viruses, I went to ; http://www.webmail.us/testvirus and emailed the eicar virus to my account. My ; mail is

Re: [Clamav-users] Compile problems ClamAV on OpenBSD 3.6

then AC_DEFINE(BUILD_CLAMD, 1, build clamd) fi Andy ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] ClamAV compile problem on Sol9 with Sun Studio 10

On Wed, 10 Aug 2005, Dennis Peterson wrote: ; Dale Walsh said: ; ; On Aug 10, 2005, at 08:12 AM, Andr?s Yacopino wrote: ; ; I have solaris too and compiled with gcc, this works great. I ; compiled it with this parameters: ; ; First i do: ; ; in /usr/local/lib ; ; ln -s

Re: [Clamav-users] CVS (20050625) compile fails

On Sat, 25 Jun 2005, Odhiambo Washington wrote: ; I am trying to compile the CVS version on FreeBSD 4.11, but it fails ; as follows: ; [.. snip ..] ; ; server-th.c: In function `acceptloop_th': ; server-th.c:437: warning: passing arg 3 of `thrmgr_new' makes integer from pointer without a cast

Re: [Clamav-users] Kudos to the developers!

product. Nonetheless, ClamAV is a credit to the developers. -- Andy Saunders Infrastructure Group Computing Services University of Oxford ___ http://lurker.clamav.net/list/clamav-users.html

[Clamav-users] Update to 0.84

this but there are no update instructions I can find in the docs. Many thanks Andy ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Update to 0.84

On Thu, 2005-05-05 at 17:31 -0500, Daniel J McDonald wrote: On Thu, 2005-05-05 at 23:17 +0100, Andy Loates wrote: Hi There, This is probably an idiots question but i've only just got my new MTA working 2 days before 0.84 was released an I dont want to mess up days of hard work by doing

[Clamav-users] Updating via freshclam without clamd?

version 0.84 and the rpm compiled binaries for redhat on the dag site. Thanks for your help Andy ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] CVS and snapshot-20050417

On Tue, 19 Apr 2005, Trog wrote: ; On Mon, 2005-04-18 at 18:22 +, Andy Fiddaman wrote: ; On Mon, 18 Apr 2005, Trog wrote: ; ; ; ; Run autoreconf ; ; Is this something that has changed and will stay this way ? I don't ; currently have the auto utilities on my Sun servers and don't really

Re: [Clamav-users] CVS and snapshot-20050417

to maintain them. If it's just a temporary mixup in CVS then I'll just wait. Thanks, Andy ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

On Thu, 17 Feb 2005, David Blank-Edelman wrote: ; Hi- ; Thanks for such a great program and all of the work being put into it. We're ; having a nasty problem with clamd 0.8x (even with 0.83 which we just installed ; yesterday). After running for a while, it will decide to just stop functioning

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

On Fri, 18 Feb 2005, David Blank-Edelman wrote: ; ; Thanks for taking the time to look into this with me. You could try the attached patch, which makes clamd increase its file descriptor limit to the OS's maximum or the maximum safe value if you're using select(). A.diff -r -u

Re: [Clamav-users] Mime

On Wed, 16 Feb 2005, [ISO-8859-2] Bogusaw Brandys wrote: ; -BEGIN PGP SIGNED MESSAGE- ; Hash: SHA1 ; ; Nigel Horne wrote: ; On Wednesday 16 Feb 2005 14:18, Ted Fines wrote: ; ; ; FOUR MINUTES, 13 SECONDS for an 800k email. ... ; 0.80 didn't scan it properly and would have let a virus

Re: [Clamav-users] Mime

with zip containing message containing zip containing message...), but not for mime recursion.. i.e. parseEmailBody recurses through embedded MIME parts with no recursion checking. Both limits would be useful with optional block on limit exceeded. Andy

Re: [Clamav-users] virus incident response?

-mail Sanitizer? http://www.impsec.org/email-tools/procmail-security.html This can be another useful piece of defense in depth... --- Andy Feldt Senior System Support Programmer Affiliate Assistant Professor Department of Physics and Astronomy The University of Oklahoma

Re: [Clamav-users] Mime

On Thu, 17 Feb 2005, Nigel Horne wrote: ; On Thursday 17 Feb 2005 15:07, Tomasz Kojm wrote: ; On Thu, 17 Feb 2005 11:50:11 + (GMT) ; Andy Fiddaman [EMAIL PROTECTED] wrote: ; ; Kind of.. there's a limit for how many times the mail scanner is ; invoked, (such as for a message with zip

Re: [Clamav-users] Mime

; [EMAIL PROTECTED] Nigel Horne [EMAIL PROTECTED] ; wrote: ; ; On Thursday 17 Feb 2005 16:07, Andy Fiddaman wrote: ; ; The problem with the old limit was that it was hard coded and so was ; the behaviour when it was exceeded (IIRC it used to just not scan ; the additional nested parts). I

[Clamav-users] clamav-milter 0.83 on AIX 5.2

(LOG_ERR, _(mkdir %s failed), newname); --- 4426,4432 --- Andy Feldt Senior System Support Programmer Affiliate Assistant Professor Department of Physics and Astronomy The University of Oklahoma ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav

[Clamav-users] Solaris 9 64-bit packages

I've set up a web page containing binary packages of ClamAV for 64-bit Solaris 9 on SPARC at http://clamav.citrus-it.net/ for anyone who wants an easy way of getting it up and running on this platform. The only package there at present is of 0.80 with the readdir_r patch backported from the

Re: [Clamav-users] clamd performance on Solaris vs Linux

On Fri, 29 Oct 2004, Fajar A. Nugraha wrote: ; James Lick wrote: ; ; Fajar A. Nugraha wrote: ; ; I have several mail relays on Sun Sparcs with Solaris 8 and 9 ; running exim, exiscan, and clamav. All the same version. ; top shows clamd uses 5%-40% CPU time (it was always ; among top 10

Re: [Clamav-users] Unable to open file or directory ERROR

On Thu, 21 Oct 2004, Grant Supp wrote: ; Andy Fiddaman wrote: ; I'm not a developer but this looks similar to what I'm seeing on Solaris. ; Is readdir_r in use here ? (grep READDIR_R clamav-config.h) ; Can you post the dirent struct from your /usr/include/sys/dirent.h file ? ; Otherwise

Re: [Clamav-users] 0.80 - FreeBSD Port Error

On Fri, 22 Oct 2004, Scott Rothgaber wrote: ; Has anyone seen this? It built OK on the test machine but the production ; machine produces these errors. Both are 4.10-RELEASE with the same packages ; installed. ; ; Thanks! ; Scott ; ; ; output.o: In function `logg_close': ; output.o(.text+0x53):

Re: [Clamav-users] Unable to open file or directory ERROR

directory entry */ unsigned short d_reclen; /* length of this record */ chard_name[1]; /* name of file */ } dirent_t; ) Otherwise the following command should give enough: find /usr/include -name \*.h -exec grep d_name {} \; Thanks, Andy

  1   2   >