On 11/04/2013 08:21 PM, Nicholas Chua wrote: > > > <snip> > > > > > > > I am very surprised that you have a list of 100+ viruses that > clamav has > > > > failed to detect. If indeed your QMT host is passing along that > number > > > > of viruses, I would expect that clamav scanning isn't happening as it > > > > should, and/or your freshclam updates aren't functioning properly. > > > > > > > > Will you please post samples from of your clamd and freshclam > logs which > > > > demonstrate its operation? > > > > > > > > Once we've verified that things are working properly, we should > contact > > > > the clamav developers about the 100+ viruses you've accumulated > and see > > > > what they have to say. I expect that they'll say they're not viruses, > > > > but some other type of malware. > > > > > > > > > > These are the some of the samples. I had used Kaspersky to name these > > > viruses. > > > > > > http://pastebin.com/QKvWJzy3 > > > > > > They are mostly Trojans and rootkits. > > > > > > Regards > > > nic > > > > > > > That's a start. > > clamd and freshclam logs? > > > > http://pastebin.com/MrdeMd2c > http://pastebin.com/jMcB0rdh > > clamd.conf and freshclam.conf repectivetly > > Regards > nic
I meant samples of log contents, not configurations. We're trying to verify that clamd is running properly, scanning emails, and is up to date. You can copy and paste some "qmlog clamd" output for the clamd log, E.g: 11-05 08:05:55 /var/qmail/simscan/1383663954.744602.29657/msg.1383663954.744602.29657: OK 11-05 08:05:55 /var/qmail/simscan/1383663954.744602.29657/addr.1383663954.744602.29657: OK 11-05 08:05:55 /var/qmail/simscan/1383663954.744602.29657/textfile0: OK 11-05 08:08:30 SelfCheck: Database status OK. 11-05 08:08:30 /var/qmail/simscan/1383664109.27361.30054/msg.1383664109.27361.30054: OK 11-05 08:08:30 /var/qmail/simscan/1383664109.27361.30054/addr.1383664109.27361.30054: OK 11-05 08:08:30 /var/qmail/simscan/1383664109.27361.30054/textfile1: OK 11-05 08:08:30 /var/qmail/simscan/1383664109.27361.30054/textfile2: OK 11-05 08:08:30 /var/qmail/simscan/1383664109.27361.30054/TAT Referral C Cons.doc: OK 11-05 08:08:54 /var/qmail/simscan/1383664134.126406.30148/msg.1383664134.126406.30148: OK 11-05 08:08:54 /var/qmail/simscan/1383664134.126406.30148/addr.1383664134.126406.30148: OK 11-05 08:08:54 /var/qmail/simscan/1383664134.126406.30148/textfile0: OK 11-05 08:11:59 /var/qmail/simscan/1383664318.859447.30710/msg.1383664318.859447.30710: OK 11-05 08:11:59 /var/qmail/simscan/1383664318.859447.30710/addr.1383664318.859447.30710: OK 11-05 08:11:59 /var/qmail/simscan/1383664318.859447.30710/textfile0: OK 11-05 08:11:59 /var/qmail/simscan/1383664318.859447.30710/textfile1: OK 11-05 08:11:59 /var/qmail/simscan/1383664318.859447.30710/textfile2: OK 11-05 08:12:00 /var/qmail/simscan/1383664319.27624.30711/msg.1383664319.27624.30711: OK 11-05 08:12:00 /var/qmail/simscan/1383664319.27624.30711/addr.1383664319.27624.30711: OK 11-05 08:12:00 /var/qmail/simscan/1383664319.27624.30711/textfile2: OK 11-05 08:12:00 /var/qmail/simscan/1383664319.27624.30711/textfile3: OK The freshclam log is a typical file: /var/log/clamav/freshclam.log. E.g.: -------------------------------------- Received signal: wake up ClamAV update process started at Tue Nov 5 05:06:18 2013 main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo) Downloading daily-18069.cdiff [100%] daily.cld updated (version: 18069, sigs: 457386, f-level: 63, builder: neo) bytecode.cld is up to date (version: 228, sigs: 43, f-level: 63, builder: neo) Database updated (2881654 signatures) from db.us.clamav.net (IP: 65.19.179.67) -------------------------------------- Received signal: wake up ClamAV update process started at Tue Nov 5 07:06:31 2013 main.cld is up to date (version: 55, sigs: 2424225, f-level: 60, builder: neo) daily.cld is up to date (version: 18069, sigs: 457386, f-level: 63, builder: neo) bytecode.cld is up to date (version: 228, sigs: 43, f-level: 63, builder: neo) -------------------------------------- -- -Eric 'shubes' --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
