On Mon, 22 Dec 2003 at 21:36:49 +0700, Fajar A. Nugraha wrote: > Hi all, > > I just process some web statistic for database.clamav.net's mirror on my > server, and I found 744 connections, in one day, from the same IP > address, all requesting daily.cvd and main.cvd, with the user agent > "ClamAV/1.0" instead of the usual "clamav/0.65" or "clamav/devel-2003xxxx" > > Anybody knows whether this a new pre-alpha release, or a user-customized > version, or is it a new virus ? > 744 updates per day from the same IP seems waaaaaaaaaaaaay too much to > be normal. >
I've just noticed that a script (by Luca) for checking mirrors uses such User-Agent string. I don't know if it was that, but it _may_ be a reason. P.S. I'm on the vacation so if you reply something, I won't read it soon. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
