Re: [clamav-users] False Positive - Win.Exploit.CVE_2016_3316-1?

2016-08-10 Thread Jan-Pieter Cornet
316-1. This means that on our medium sized ISP, we got so many false positives from ClamAV in a few hours, that it would take several weeks for ClamAV to even find the same number of true positives in our e-mail stream. Guess that's the end of ClamAV as an e-mail virus scanner here... --

Re: [clamav-users] confirm fc348079837XXXXXXXXXXXXXXXXXXXXXXXXb8a2a7

2012-11-20 Thread Jan-Pieter Cornet
choose whatever he or she likes. But ADSP doesn't appear to be getting a lot of leverage, and if dmarc does take off, ADSP will be obsolete. -- Jan-Pieter Cornet SSL is only keeping your connection safe from hackers, crooks and three letter agencies by the least secured, least like

Re: [clamav-users] Untit Testing

2012-02-07 Thread Jan-Pieter Cornet
there's a virus in range, they just die :) PS ;-) -- Jan-Pieter Cornet SSL is only keeping your connection safe from hackers, crooks and three letter agencies by the least secured, least likely to refuse money from strangers, and least bullying-proof of several hundred compani

Re: [clamav-users] daily.cvd update issue.

2011-07-19 Thread Jan-Pieter Cornet
On 2011 Jul 19, at 17:20 , Luca Gibelli wrote: > http://www.clamav.net/support/ml What? If websites are a requirement for ClamAV then this project is doomed. I don't see our NOC surfin the interwebz as part of the job. (Sarcasm alert). -- Jan-Pieter Cornet "People are

Re: [clamav-users] Virus not detected by Clamav

2011-06-29 Thread Jan-Pieter Cornet
can trivially create your own signature using an md5 hash and use that instantly. That's one of the things I particularly like about clamav (and used a couple of times in the past). -- Jan-Pieter Cornet "People are continuously reinventing the flat tyre". PGP.sig Descri

Re: [clamav-users] What happened to 12663 ?

2011-02-11 Thread Jan-Pieter Cornet
On 2011 Feb 11, at 17:56 , Vincent Fox wrote: > On 2/11/2011 8:31 AM, Jan-Pieter Cornet wrote: >> On the other hand, since you haven't updated ClamAV in over a year, leading >> to (significantly) decreased detection, maybe the scanning of email isn't >> top p

Re: [clamav-users] What happened to 12663 ?

2011-02-11 Thread Jan-Pieter Cornet
d, since you haven't updated ClamAV in over a year, leading to (significantly) decreased detection, maybe the scanning of email isn't top priority, and your mail scanning engine needs to fallback to letting mail through on scan errors. -- Jan-Pieter Corne

Re: [clamav-users] how do I get an old daily. cvd and cld? file?

2011-02-10 Thread Jan-Pieter Cornet
rsion: 12660 Signatures: 37218 Functionality level: 58 Builder: edwin MD5: 4518087caf519a9f0d28135aade4e2a8 Digital signature: x34ZJRr8E4mKeTiDl+XotNCMI6BEdCnZHi8F9AyX3o9L8LFQEXUZLXi2y6B4A7NyUtSbfj4e8+bOWFlB9dTw3aQBBRr0sfc4C5G/B1zOoIDggfBBe7ZqCqD4pzMCZDnOW4QCvh1BH/44GZft6xnVPpPxqfy2OsHkhorvOPAsZXh Ve

Re: [clamav-users] Sophos Anti-Virus

2011-01-03 Thread Jan-Pieter Cornet
t false positives, because you can treat files/emails that are only recognized by one scanner differently from the ones that are recognized by multiple scanners. For example quarantine in the first case, and remove in the second case. (This requires custom programming, of course). -- Jan-Piet

Re: [Clamav-users] How does Clam stand up to Commercial A/V?

2009-12-03 Thread Jan Pieter Cornet
time isn't free either, ClamAV is definately worse than commercial AV products, even if you consider performance/price ratio. Be aware that YMMV. -- Jan-Pieter Cornet !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and d

Re: [Clamav-users] please remove

2009-02-20 Thread Jan Pieter Cornet
rules, then bye bye, unsubscribe *.uk and go and have fun on clamav-uk-us...@lists.1984.gov.uk. Or at least, that's what I'd say if I were the list operator, which I'm not (I do administrate other email lists, though) Capice? -- Jan-Pieter Cornet !! Disclamer: The addressee o

Re: [Clamav-users] Why is ClamAV signature file so unpopular?

2008-11-29 Thread Jan Pieter Cornet
n trust the signature file? Because it's PGP signed. It's not just an md5 hash. > Anyone in a position to compromise one would almost definitely be able > to compromise the other. Sure. But it would be suspect if gpg/pgp says: Good Signature by Snake Oil <[EMAIL PROTECTED]&

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-17 Thread Jan Pieter Cornet
quot; hosts that push changes out to the production systems. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Pleas

Re: [Clamav-users] No viruses detected since 1711GMT August 29, 2008?

2008-08-30 Thread Jan Pieter Cornet
tely big ISP, there's always something coming in. The graphs are at: http://www.xs4all.nl/en/veiligheid/statistieken.php (The URL itself is partly in Dutch, but don't let that scare you, the page itself is in English) -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee

Re: [Clamav-users] announcing ClamAV 0.94rc1

2008-08-19 Thread Jan Pieter Cornet
h really such a big deal now that people usually toss DVD images around?) Also note - every other virus scanner I'm aware of also comes with a database "out of the box" (that sophos update I just downloaded was also 24Meg). Of course, outdated as soon as you hit "Download&quo

Re: [Clamav-users] Clamav phishing sigs

2008-08-08 Thread Jan Pieter Cornet
st, some do, it seems. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indefinitely to allow ver

Re: [Clamav-users] simplest replacement for ancient amavis-perl

2008-08-08 Thread Jan Pieter Cornet
f the already insignificant amount of email viruses (we don't count phishes as a virus, they add to the score in SA). -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and d

Re: [Clamav-users] Freshclam not terminating correctly

2008-06-03 Thread Jan-Pieter Cornet
this on our mirror, there are no connections stuck in FIN_WAIT_1 at all. Could it be that all stuck connections you see, are the result of some popular DSL-router/NAT box in your area, that behaves badly? -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email

Re: [Clamav-users] Suspect.Zip

2008-04-22 Thread Jan-Pieter Cornet
On Mon, Apr 21, 2008 at 11:45:39PM +0200, Jan-Pieter Cornet wrote: > One of my customers is reporting that a file is being blocked as > "Suspect.Zip". I haven't got a copy of the file itself, however, > I started looking for the virus signature (as it is definately a >

[Clamav-users] Suspect.Zip

2008-04-21 Thread Jan-Pieter Cornet
again unpleasantly surprised by this. It is *NOT* the task of clamav to detect broken archives, if you cannot extract the archive, give up, or AT MOST have a configuration option on how to proceed (like ArchiveBlockEncrypted). -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addres

Re: [Clamav-users] Non-Windoze Viruses (was Re: Memory usage for clamd is huge)

2008-04-02 Thread Jan-Pieter Cornet
;ll have to google it. (how far away from viruses are we yet?) -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message ind

Re: [Clamav-users] Non-Windoze Viruses (was Re: Memory usage for clamd is huge)

2008-04-01 Thread Jan-Pieter Cornet
re are tons of readily exploitable php out there? These exploited unix servers aren't sending out viruses just because the spammer/botherder has better use for them at this moment, not because it's impossible. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of t

Re: [Clamav-users] Vasiliy Bochin в команд ировке

2008-03-26 Thread Jan-Pieter Cornet
gram does not auto-respond to mailinglist mails, especially not to the list itself. On some mailinglists, it is grounds for immediate removal. さよなら -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test

Re: [Clamav-users] False positive Phishing.Heuristics.Email.SpoofedDomain

2008-02-22 Thread Jan-Pieter Cornet
one who actually cares about delivering valid email to their users, should switch this off. > What I would like to know is why is this considered Phishing? > > What characterizes Phishing.Heuristics.Email.SpoofedDomain classification? > > What can I do to avoid such classification? -

Re: [Clamav-users] live CD

2008-01-22 Thread Jan-Pieter Cornet
live CD on a USB memory stick, which then has the ability to update itself. google gave me this: http://www.debuntu.org/how-to-install-ubuntu-linux-on-usb-bar -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This

Re: [Clamav-users] Reconfiguring Clam AV

2008-01-09 Thread Jan-Pieter Cornet
ransfer. These are harmless. (At least, I assumed they are harmless. I should fix the exclude file on rsync one of these days to skip those tempfiles :) -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test o

Re: [Clamav-users] TK53 Advisory #2: Multiple vulnerabilities in ClamAV

2008-01-03 Thread Jan-Pieter Cornet
hink that article pretty much gives every suggestion that also went to this mailinglist in the past few days (regarding the random generation, at least). -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of

Re: [Clamav-users] Email viruses almost non-existent?

2007-12-25 Thread Jan-Pieter Cornet
virusscanner, at some point, to keep the users secure. And at the moment the NSA (or your local favorite TLA secret agency) hears that that is possible, ISPs will get a request for some more functionality in the transparent proxy, and your privacy will be completely hosed. -- Jan-Pieter Cornet <

Re: [Clamav-users] Phishing feature defaults, naming, and 0.92

2007-11-15 Thread Jan-Pieter Cornet
alse positives (or you'd need a pretty huge test set). Since we're "reasonably" protected from FPs anyway, we decided to put it in production, but found out we were tempfailing legitimate paypal mails soon after, so we disabled the URL scanning. -- Jan-Pieter Cornet <[EMAIL P

Re: [Clamav-users] Phishing feature defaults, naming, and 0.92

2007-11-15 Thread Jan-Pieter Cornet
mails in a special folder. > > Why does this make you wanting to drop the use of ClamAV? > You can filter based on "virus found name", and those containing > 'Heuristics' can go to > your special folder. > Or you can turn the feature entirely off. If we do sto

Re: [Clamav-users] Accurate subjects (was Re: PhishingScanURLs is dreadfully slow/CPU-intensive)

2007-11-13 Thread Jan-Pieter Cornet
itimate bulk mailers), so we put such mails in a special folder. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. P

Re: [Clamav-users] RFC: Recognize mbox format

2007-10-04 Thread Jan-Pieter Cornet
it isn't excessive so it can skip beyond the next header into the next message body. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive

Re: [Clamav-users] Updated unofficial-sigs.sh script available

2007-09-25 Thread Jan-Pieter Cornet
comes without perl if you do a bare bones install. Then again, FreeBSD date groks %s). So, TIMTOTDI squared (look ma', no perl!). This does the same as date +%s too: echo|awk '{print systime()}' -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of

Re: [Clamav-users] Updated unofficial-sigs.sh script available

2007-09-25 Thread Jan-Pieter Cornet
On Tue, Sep 25, 2007 at 03:17:35PM -0700, Bill Landry wrote: > > Epoch time: > > perl -e 'print time() . "\n";' Golfed: perl -le print+time You can even leave the -l switch if used in ``, because the trailing newline doesn't matter there. -- Jan-Pieter Co

Re: [Clamav-users] heuristic phishing detection causes lots of false positives

2007-09-19 Thread Jan-Pieter Cornet
such atrocities. Good luck. Really. May I suggest Mail::SpamAssassin::Plugin::DonQuixote ? But please, in any case, stay away from virus scanning, because it has nothing to do with that. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended rec

[Clamav-users] heuristic phishing detection causes lots of false positives

2007-09-19 Thread Jan-Pieter Cornet
ing 5-10 million mails a day, could be that we're seeing more false positives due to the high volume) -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Ple

Re: [Clamav-users] Problems with installation

2007-08-02 Thread Jan-Pieter Cornet
till only just beginning to upgrade our several clusters of FreeBSD 4 machines. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message i

Re: [Clamav-users] clamscan extremly slow

2007-06-18 Thread Jan-Pieter Cornet
artup time appears to be fixed in 0.91rc1. Kudos to the delopers for recognising one of the roots of all evil). So I don't think it's mimedefang that should label the clamscan method as "not for production use". -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclame

Re: [Clamav-users] Clamav-milter

2007-03-14 Thread Jan-Pieter Cornet
you ever send a notification "an email was addressed to you but it contained a virus", that you will NOT send such notifications outside of your own organisation, EVER. Not even in the form of an out-of-office reply to such a message. -- Jan-Pieter Cornet <[EMAIL PROTECTED]>

Re: [Clamav-users] Handling the daily.cvd to daily.inc transition in a packaging context

2007-03-10 Thread Jan-Pieter Cornet
On Sat, Mar 10, 2007 at 11:26:10AM +0100, Marc Haber wrote: > On Sat, Mar 10, 2007 at 11:11:39AM +0100, Jan-Pieter Cornet wrote: > > Just put this in your freshclam.conf: > > > > ScriptedUpdates no > > > > It will make sure only .cvd files are downloaded. >

Re: [Clamav-users] Handling the daily.cvd to daily.inc transition in a packaging context

2007-03-10 Thread Jan-Pieter Cornet
now puts in the virus database directory. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indefinite

Re: [Clamav-users] Local mirror with .90

2007-02-23 Thread Jan-Pieter Cornet
since I used to compare "cat $databasedir/* | md5" from before and after the upgrade to know whether to notify clamd or not. Since $databasedir now contains subdirs, I needed to modify that somewhat. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email

Re: [Clamav-users] Problem with upgrade

2007-02-20 Thread Jan-Pieter Cornet
;t open/parse the config file /usr/local/etc/clamd.conf > [FALLITO] > > Where is my error ? You forgot to look at the UPGRADE file. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the eche

Re: OT: Re: [Clamav-users] Auto scan problems

2007-02-19 Thread Jan-Pieter Cornet
(... and you'r living inside the tardis and really did send this from the future. It isn't Tue 20 Feb 2007 22:28 yet, not even for kiwis). (ObClam: while you're there, submit some very fresh virus samples to the clam team, and clamav might be able to start blocking the virus befor

Re: [Clamav-users] Scan report problems with 0.90...

2007-02-18 Thread Jan-Pieter Cornet
On Sun, Feb 18, 2007 at 01:38:56AM +0100, Jan-Pieter Cornet wrote: > I've just compiled a clamav 0.90 --enable-experimental, and installed > that on another bunch of servers, I'll have statistics on its speed > tomorrow. Preliminary results over 2000 samples aren't show

Re: [Clamav-users] Stats script quits working after upgrade

2007-02-18 Thread Jan-Pieter Cornet
ot;. I'm not good at regex's, I > suppose its a simple fix, would someone be kind enough to show me how to make > the change? I think this is the line that needs editing: > > } elsif (/(\w+)\s(\w+)\s{1,2}(\d{1,2})\s(\d+:\d+:\d+)\s(\d+).+stream:\s(. > +)\sFOUND/ ) { Quick f

Re: [Clamav-users] Scan report problems with 0.90...

2007-02-17 Thread Jan-Pieter Cornet
0.90 --enable-experimental, and installed that on another bunch of servers, I'll have statistics on its speed tomorrow. Preliminary results over 2000 samples aren't showing a huge improvement either. For comparison: sophos (via sophie): 27 ms/mail, f-prot (via fprotd): 40 ms/mail (again

Re: [Clamav-users] Problem running virus-scanner

2007-02-15 Thread Jan-Pieter Cornet
ts to clamscan: clamscan --mbox --stdout --disable-summary --infected $FILE If you remove (in the mimedefang.pl source) all options except "--stdout", it should work. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended

Re: [Clamav-users] Re: Newbie-inquiry

2006-12-19 Thread Jan-Pieter Cornet
t could also be done by spamassassin is not to my benefit, CPU-wise... I was hoping that this would change with 0.90, but I haven't tried it on our production platforms yet. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recip

Re: [Clamav-users] Forcing clamd to reload its database

2006-12-13 Thread Jan-Pieter Cornet
GUSR2, according to the documentation. kill -USR2 `cat /path/to/clamd.pid` -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indef

Re: [Clamav-users] Choosing best MaxThreads value for clamd?

2006-11-30 Thread Jan-Pieter Cornet
ut usually something like 20%. Don't worry too much about taskswitching. -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention system

Re: [Clamav-users] How to run clamscan for a list of files from a file?

2006-11-28 Thread Jan-Pieter Cornet
rror: > > /usr/bin/clamscan: Argument list too long Try: clamscan --recursive /tmp/clamscan/ -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !

Re: [Clamav-users] This seems particularly nasty

2006-10-23 Thread Jan-Pieter Cornet
eces of malware can be considered legitimate. Practicing safe software-exchange is about the only true remedy against viruses. Well, right after thinking rationally about the actions you take that put you at risk. If your management truly cares about virus protection, they would take appropriate actions li

Re: [Clamav-users] hit max-children limit

2006-09-06 Thread Jan-Pieter Cornet
is, we say "200 OK" and junk the mail into the black hole). This prevents most false positives (which are rare, but not non-existent), and keeps the amount of "bounced" viruses to a minimum (even if it is bounced by the sending mail server). -- Jan-Pieter Cornet <

Re: [Clamav-users] hit max-children limit

2006-09-06 Thread Jan-Pieter Cornet
ause of spam, by the way, viruses are down to a staggering low of around 300milliviruses per second now :) It spiked to around 30 viruses/sec at the beginning of this year. See http://www.xs4all.nl/uk/veiligheid/statistieken.php if you're interested in numbers of viruses detected. -- Jan

Re: [Clamav-users] Small number of ClamAV known viruses ?

2006-07-18 Thread Jan-Pieter Cornet
ne wouldn't want to use clamav, even if you already have another virus scanner: it also makes a good companion to a commercial virus scanner, since not every scanner detects every virus (or virus fragment, like a truncated bounce or a badly disinfected mail, which is more common). Hope this he

Re: [Clamav-users] Disable Specific Document Scanning

2006-07-13 Thread Jan-Pieter Cornet
hitelist the domain and/or filetype from scanning. You wouldn't want the next excel macro virus to spread through your mail server, and having the rest of the world point to you saying: "He's the one! He disabled the virus filters, allowing the stuff to spread!" -- Jan-Pieter Cor

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
atabase updates. It's likely however your customer won't hit the same FP twice in short succession (at least - in my experience. FPs are still quite rare). -- Jan-Pieter Cornet <[EMAIL PROTECTED]> !! Disc lamer: The addressee of this email is not the intended recipient. !! !! This is

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
On Tue, May 23, 2006 at 12:49:50PM -0700, Kelson wrote: > Jan Pieter Cornet wrote: > >Maybe "tons" is slightly exaggerated? Out of approximately 10 million > >emails today, our logs show one hit for XF.Sic.L, and then another hit > >when that email was bounce

Re: [Clamav-users] XF.Sic.L def is causing tons of false positives

2006-05-23 Thread Jan Pieter Cornet
ntaining "XF.Sic.L" and remove that, and point your virus scanner to the extracted files (which have to be in another directory than the .cvd files). Or provide a non-virus-scanned email address, or non-virus-scanned outgoing mail server (usable with specific SMTP AUTH only), or something. --

Re: [Clamav-users] Disallowed characters found in MIME headers

2006-03-06 Thread Jan Pieter Cornet
On Mon, Mar 06, 2006 at 02:23:51PM -0800, Alex Gottschalk wrote: > Jan Pieter Cornet wrote: > >On Mon, Mar 06, 2006 at 12:20:11PM -0800, Alex Gottschalk wrote: > >>Replacing the CRLF with a bare LF in these headers causes Clamav to no > >>longer quarantine these mail me

Re: [Clamav-users] Disallowed characters found in MIME headers

2006-03-06 Thread Jan Pieter Cornet
ction 2.3.7: "SMTP client implementations MUST NOT transmit ["bare" "CR" or "LF" characters] except when they are intended as line terminators and then MUST, as indicated above, transmit them only as a sequence." So it looks like the fault is in your mime-enc

Re: [Clamav-users] RE: Report infected mail to the user

2006-01-10 Thread Jan Pieter Cornet
ECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Phishing - ClamAV and version 0.9

2006-01-06 Thread Jan Pieter Cornet
it, if there is interest. -- #!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%

Re: [Clamav-users] Any updates for Lupper Virus?

2005-11-09 Thread Jan Pieter Cornet
.Lupii Exploit.Linux.Lupii-2 -- #!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.e

Re: [Clamav-users] Yahoo uses ClamAV, listed in abuse.rfc-ignorant.org

2005-10-26 Thread Jan Pieter Cornet
m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Amavisd source code

2005-10-04 Thread Jan Pieter Cornet
z/Art/Bart-Google.gif -- #!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;

Re: [Clamav-users] clamav-milter seems unstable with 0.87

2005-09-26 Thread Jan Pieter Cornet
p;)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] MailFollowURLs

2005-09-20 Thread Jan Pieter Cornet
27;',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] announce?

2005-07-26 Thread Jan Pieter Cornet
/,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Reporting Phishing Mails?

2005-05-29 Thread Jan Pieter Cornet
p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Re: virus passing through clamav-milter, but not through clamdscan!

2005-05-20 Thread Jan Pieter Cornet
vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Sober.P

2005-05-13 Thread Jan Pieter Cornet
-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Virus Volumes

2005-04-14 Thread Jan Pieter Cornet
dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Latest virusdb update - mismatched signature count?

2005-03-17 Thread Jan Pieter Cornet
[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] 0.81rc1 - html documentation missing, intentional?

2005-01-27 Thread Jan Pieter Cornet
$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] 0.81rc1 - html documentation missing, intentional?

2005-01-27 Thread Jan Pieter Cornet
ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] Sendmail Milter

2005-01-14 Thread Jan Pieter Cornet
_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] RE: Re: This is how I use ClamAV

2004-12-06 Thread Jan Pieter Cornet
On Fri, Dec 03, 2004 at 02:54:44PM -0800, Todd Lyons wrote: > Jan Pieter Cornet wanted us to know: > >What I find really odd is your complete lack of Worm.Sober-I. Our stats for > >Thu Dec 2: > > Good point. I had totally missed that too. > > >Top-5: > >

Re: [Clamav-users] RE: Re: This is how I use ClamAV

2004-12-03 Thread Jan Pieter Cornet
i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] Notification E-mail

2004-09-22 Thread Jan Pieter Cornet
On Tue, Sep 21, 2004 at 06:39:25PM -0500, Damian Menscher wrote: > On Wed, 22 Sep 2004, Jan Pieter Cornet wrote: > >On Mon, Sep 20, 2004 at 04:26:40PM -0700, [EMAIL PROTECTED] > >wrote: > >>It is perfectly acceptable to place an explanatory message in an SMTP > >>

Re: [Clamav-users] Notification E-mail

2004-09-21 Thread Jan Pieter Cornet
But unfortunately, you cannot change the "success" reply with milter :( -- #!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f

Re: [Clamav-users] Newbie: Clamav and Sendmail milter config

2004-08-24 Thread Jan Pieter Cornet
3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet --

Re: [Clamav-users] Idea for more timely virusdb updates

2004-08-13 Thread Jan Pieter Cornet
/,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet --- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk

Re: [Clamav-users] Idea for more timely virusdb updates

2004-08-10 Thread Jan Pieter Cornet
#!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]> $p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+ $_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;

Re: [Clamav-users] Idea for more timely virusdb updates

2004-08-09 Thread Jan Pieter Cornet
t//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig;# Jan-Pieter Cornet --- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R

[Clamav-users] clamd on FreeBSD with linuxthreads?

2004-08-02 Thread Jan Pieter Cornet
)[map{((ord$&)%32-1)/$_%3}(9, 3,1)]),5,1)='`'lt$&;$f.eig; # Jan-Pieter Cornet --- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge i