RE: [Clamav-users] This seems particularly nasty

2006-10-23 Thread Bowie Bailey
Dennis Peterson wrote: Christoph Cordes wrote: Dennis Peterson wrote: I already know the question is difficult, but it isn't impossible to answer as there are other AV vendors who have a solution for this particular problem if the article is to be believed. So you want to know

Re: [Clamav-users] Re: Clamav-milter with Postfix

2006-10-23 Thread Don Russell
G.W. Haywood wrote: Hi there, On Mon, 23 Oct 2006 Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested in scanning outgoing mail. Perhaps someone has an idea how to correct this problem. Because you don't scan outgoing mail

Re: [Clamav-users] This seems particularly nasty

2006-10-23 Thread Dennis Peterson
Bowie Bailey wrote: Dennis Peterson wrote: Christoph Cordes wrote: Dennis Peterson wrote: I already know the question is difficult, but it isn't impossible to answer as there are other AV vendors who have a solution for this particular problem if the article is to be believed. So you want

[Clamav-users] Clamdscan instead of Clamscan

2006-10-23 Thread Bill Berg
We are running Clamav with MailScanner, and the server load is very high. I have read here and elsewhere that using clamdscan and the clamd daemon will run better than using clamscan. But I can't find where or how to make that switch. It isn't in any of the config files on the server. Is this a

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Dennis Peterson
Gerard Seibert wrote: On Sunday October 22, 2006 at 09:49:38 (PM) Dennis Peterson wrote: Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested in scanning outgoing mail. Perhaps someone has an idea how to correct this problem. Because

Re: [Clamav-users] Clamdscan instead of Clamscan

2006-10-23 Thread Dennis Peterson
Bill Berg wrote: We are running Clamav with MailScanner, and the server load is very high. I have read here and elsewhere that using clamdscan and the clamd daemon will run better than using clamscan. But I can't find where or how to make that switch. It isn't in any of the config files on the

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Don Russell
Henrik Krohns wrote: On Mon, Oct 23, 2006 at 05:53:30AM -0400, Gerard Seibert wrote: Anyway, we send out several times a week flyers to our customers. These mailings range from 750 to 2000 messages per run. To scan 2000 identical messages is insane, not to mention a total waste of system

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Kevin W. Gagel
- Original Message - Dennis Peterson Gerard Seibert wrote: Because you don't scan outgoing mail I have to scan incoming mail from you. My usual response when I read this kind of thing is to just go ahead and blacklist you now rather than later. Please practice safe messaging.

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Gerard Seibert
On Monday October 23, 2006 at 11:49:47 (AM) Dennis Peterson wrote: Gerard Seibert wrote: On Sunday October 22, 2006 at 09:49:38 (PM) Dennis Peterson wrote: Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested in scanning

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Dennis Peterson
Kevin W. Gagel wrote: - Original Message - Dennis Peterson Gerard Seibert wrote: Because you don't scan outgoing mail I have to scan incoming mail from you. My usual response when I read this kind of thing is to just go ahead and blacklist you now rather than later. Please practice

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Dennis Peterson
Gerard Seibert wrote: On Monday October 23, 2006 at 11:49:47 (AM) Dennis Peterson wrote: Gerard Seibert wrote: On Sunday October 22, 2006 at 09:49:38 (PM) Dennis Peterson wrote: Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Chuck Swiger
On Oct 22, 2006, at 10:50 PM, Tom Metro wrote: [ ...heated debate aside :-), these questions are interesting... ] Is there really much practical value to outbound scanning? Yes. I've seen employees download viral mail from some other service (AOL, fastmail.fm, gmail, whatever) to their

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Gerard Seibert
On Monday October 23, 2006 at 01:20:54 (PM) Chuck Swiger wrote: On Oct 22, 2006, at 10:50 PM, Tom Metro wrote: [ ...heated debate aside :-), these questions are interesting... ] Is there really much practical value to outbound scanning? Yes. I've seen employees download viral mail from

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Chuck Swiger
On Oct 23, 2006, at 11:02 AM, Gerard Seibert wrote: It doesn't stop all potential problems with outbound email from your domain, but together with adding SPF records and using a firewall to block outbound port 25 except from your legitimate mail relay, you can do a lot to keep your domain from

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Kevin W. Gagel
- Original Message - From: Chuck Swiger [EMAIL PROTECTED] (I can't block senders just because they don't have reverse DNS configured, or because forward and reverse DNS does not match.) Chuck, Yes you can block them if they don't have a revers DNS. No you shouldn't block them if the

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Tom Metro
Chuck Swiger wrote: Tom Metro wrote: Is there really much practical value to outbound scanning? Yes. I've seen employees download viral mail from some other service (AOL, fastmail.fm, gmail, whatever) to their corporate desktop, get infected, and have their machine start spewing malicious

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Chuck Swiger
On Oct 23, 2006, at 11:35 AM, Kevin W. Gagel wrote: From: Chuck Swiger [EMAIL PROTECTED] (I can't block senders just because they don't have reverse DNS configured, or because forward and reverse DNS does not match.) Chuck, Yes you can block them if they don't have a revers DNS. No you

[Clamav-users] clamav-milter problem

2006-10-23 Thread Nicholas Anderson
Hi All, i've just installed ClamAV 0.88.5 together with sendmail/milter in a slackware server. It worked fine this weekend but today, as traffic has grown, clamav-milter started dying without leaving any clear error message. The messages it's left in log were: Oct 22 04:44:28 manguinhos

[Clamav-users] Re: Clamdscan instead of Clamscan

2006-10-23 Thread René Berber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Bill Berg wrote: We are running Clamav with MailScanner, and the server load is very high. I have read here and elsewhere that using clamdscan and the clamd daemon will run better than using clamscan. But I can't find where or how to make that

Re: [Clamav-users] This seems particularly nasty

2006-10-23 Thread Jan-Pieter Cornet
On Mon, Oct 23, 2006 at 08:29:20AM -0700, Dennis Peterson wrote: That's not the question. The question as asked by management is Why does ClamAV report it doesn't catch this virus while these others do? and my answer is I don't know - and the ClamAV people don't know, either. For this

RE: {Spam?} [Clamav-users] Re: Clamdscan instead of Clamscan

2006-10-23 Thread Bill Berg
Actually, as per another reply, I was able to locate in the /usr/lib/MailScanner/clamav-wrapper file the lines where it invoked clamscan. I was able to change this to clamdscan and knocked the server load down from around 8 to 1.5, although I'm not really sure that clamdscan is doing anything. The

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Tom Metro
Dennis Peterson wrote: Gerard Seibert wrote: ...I am not particularly interested in scanning outgoing mail. Because you don't scan outgoing mail I have to scan incoming mail from you. Is there really much practical value to outbound scanning? Isn't the vast majority of viruses and spam

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Henrik Krohns
On Mon, Oct 23, 2006 at 01:50:12AM -0400, Tom Metro wrote: Dennis Peterson wrote: Gerard Seibert wrote: ...I am not particularly interested in scanning outgoing mail. Because you don't scan outgoing mail I have to scan incoming mail from you. For any small shop that keeps a close

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Don Russell
Tom Metro wrote: Dennis Peterson wrote: Gerard Seibert wrote: ...I am not particularly interested in scanning outgoing mail. Because you don't scan outgoing mail I have to scan incoming mail from you. That makes me think of two things: 1 - The corollary to that

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Dennis Peterson
Tom Metro wrote: Dennis Peterson wrote: Gerard Seibert wrote: ...I am not particularly interested in scanning outgoing mail. Because you don't scan outgoing mail I have to scan incoming mail from you. Is there really much practical value to outbound scanning? Isn't the vast majority of

Re: [Clamav-users] outbound scanning

2006-10-23 Thread Dennis Peterson
Don Russell wrote: Tom Metro wrote: Dennis Peterson wrote: Gerard Seibert wrote: ...I am not particularly interested in scanning outgoing mail. Because you don't scan outgoing mail I have to scan incoming mail from you. That makes me think of two things: 1 - The corollary to

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Gerard Seibert
On Sunday October 22, 2006 at 09:49:38 (PM) Dennis Peterson wrote: Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested in scanning outgoing mail. Perhaps someone has an idea how to correct this problem. Because you don't

[Clamav-users] Re: Clamav-milter with Postfix

2006-10-23 Thread G.W. Haywood
Hi there, On Mon, 23 Oct 2006 Gerard Seibert wrote: I would rather not use the '--force-scan' option since I am not particularly interested in scanning outgoing mail. Perhaps someone has an idea how to correct this problem. Because you don't scan outgoing mail I have to scan

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Henrik Krohns
On Mon, Oct 23, 2006 at 05:53:30AM -0400, Gerard Seibert wrote: Anyway, we send out several times a week flyers to our customers. These mailings range from 750 to 2000 messages per run. To scan 2000 identical messages is insane, not to mention a total waste of system resources. Other than

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Christopher X. Candreva
On Mon, Oct 23, 2006 at 05:53:30AM -0400, Gerard Seibert wrote: Anyway, we send out several times a week flyers to our customers. These mailings range from 750 to 2000 messages per run. To scan 2000 identical messages is insane, not to mention a total waste of system resources. Other than

Re: [Clamav-users] Clamav-milter with Postfix

2006-10-23 Thread Gerard Seibert
On Monday October 23, 2006 at 07:01:47 (AM) Christopher X. Candreva wrote: On Mon, Oct 23, 2006 at 05:53:30AM -0400, Gerard Seibert wrote: Anyway, we send out several times a week flyers to our customers. These mailings range from 750 to 2000 messages per run. To scan 2000 identical

[Clamav-users] clamav-milter exiting

2006-10-23 Thread Michael Grant
Clamav-milter keeps exiting on me, here's the entry in the log: LibClamAV debug: /var/tmp//clamav-404c95520e84423fd3e77caacd7b08e0/main.db loaded LibClamAV debug: Initializing md5 list structure LibClamAV debug: /var/tmp//clamav-404c95520e84423fd3e77caacd7b08e0/main.hdb loaded LibClamAV debug:

[Clamav-users] Disallowed content found in MIME attachment

2006-10-23 Thread Jeffrey R. Montgomery
It seems that I am blocking power point files. I know these files do not have a virus. How can I allow the power point type through? Thanks Jeff ___ http://lurker.clamav.net/list/clamav-users.html