Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 9, 2006, at 2:09 PM, Jim Redman wrote: Folks, I have to say, of all the lists I subscribe to, the vocal members of this list are the most arrogant and insulting. However, I consider comments such as Luca Gibelli's, bandwidth wasting, We are happy to suffer this loss. and Dennis

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 9, 2006, at 2:40 PM, Daniel J McDonald wrote: On Thu, 2006-11-09 at 10:24 -0500, Bart Silverstrim wrote: On Nov 7, 2006, at 6:48 PM, Jim Redman wrote: Chris, Christopher X. Candreva wrote: On Tue, 7 Nov 2006, Jim Redman wrote: My observation is that of all the modern packages

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 9, 2006, at 7:23 PM, Tom Metro wrote: Dennis Peterson wrote: Jim Redman wrote: Your opinions, seem to be the prevalent attitude of the vocal members of this list - if you don't suffer, it wasn't worth it. His specific problem is he lacks the skill to install and manage the product.

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 10, 2006, at 9:45 AM, Jim Maul wrote: Bart Silverstrim wrote: On Nov 9, 2006, at 2:09 PM, Jim Redman wrote: Folks, I have to say, of all the lists I subscribe to, the vocal members of this list are the most arrogant and insulting. However, I consider comments such as Luca

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 10, 2006, at 4:10 PM, jef moskot wrote: On Fri, 10 Nov 2006, Bart Silverstrim wrote: On Nov 10, 2006, at 11:07 AM, jef moskot wrote: If some packages install without difficulty and others do not, then how about we work together to bring the less efficient packages in line

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-10 Thread Bart Silverstrim
On Nov 10, 2006, at 6:28 PM, Gary V wrote: Hmm, I wonder how many of the people who responded in one way or another is actually familiar with the package in question. I have been using Linux for a couple years now and have installed thousands of packages. In general, I have not had any

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-09 Thread Bart Silverstrim
On Nov 7, 2006, at 6:48 PM, Jim Redman wrote: Chris, Christopher X. Candreva wrote: On Tue, 7 Nov 2006, Jim Redman wrote: Your opinions, seem to be the prevalent attitude of the vocal members of this list - if you don't suffer, it wasn't worth it. I would disagree, in that I don't see

Re: [Clamav-users] Cherishing my ignorance - An appeal to package rs

2006-11-09 Thread Bart Silverstrim
On Nov 7, 2006, at 6:16 PM, Jim Redman wrote: Steve, Steve Holdoway wrote: You really do need to get out of the mindset that you don't actually need to know what you're doing to administer a server. It is *NOT* a trivial task, requires skills to support it, and years of experience to

Re: Out of Office AutoReply: [Clamav-users] Question About Quarantine

2006-05-17 Thread Bart Silverstrim
On May 17, 2006, at 12:36 PM, Jim Maul wrote: Daniel T. Staal wrote: On Wed, May 17, 2006 12:12 pm, Jim Maul said: If you are on a mail list such as this, think longer and harder than usual. Then don't do it. Right. That seems like an acceptable solution. Hell, why even have

Re: Now OT - Re: Out of Office AutoReply: [Clamav-users] Question About Quarantine

2006-05-17 Thread Bart Silverstrim
On May 17, 2006, at 12:56 PM, Daniel T. Staal wrote: On Wed, May 17, 2006 12:35 pm, Christopher X. Candreva said: On Wed, 17 May 2006, Daniel T. Staal wrote: These days, being out of the office, or town, or country, is no reason for you to not be able to get your email, if you felt you

Re: [Clamav-users] OOO (was: Question AboutQuarantine)

2006-05-17 Thread Bart Silverstrim
On May 17, 2006, at 12:55 PM, [EMAIL PROTECTED] wrote: At 09:27 AM 5/17/2006, Daniel T. Staal wrote: Luckily, my spam filter catches them. That's all they are, anyway. More spam. as opposed to annoying copyright notifications attached to email published to mailing lists, that state

Re: Now OT - Re: Out of Office AutoReply: [Clamav-users] Question About Quarantine

2006-05-17 Thread Bart Silverstrim
On May 17, 2006, at 1:42 PM, Christopher X. Candreva wrote: On Wed, 17 May 2006, Bart Silverstrim wrote: That's where you're both wrong. It's an extension to instant messaging. Why Really ? That's amazing, that email managed to be invented at least a decade before IM and still extended

Re: [Clamav-users] OT: Copyright (was: Re: Out of Office AutoReply)

2006-05-17 Thread Bart Silverstrim
On May 17, 2006, at 1:53 PM, Daniel T. Staal wrote: On Wed, May 17, 2006 1:34 pm, [EMAIL PROTECTED] said: At 10:31 AM 5/17/2006, Daniel T. Staal wrote: On Wed, May 17, 2006 1:23 pm, [EMAIL PROTECTED] said: as opposed to annoying copyright notifications attached to email published to

Re: [Clamav-users] Virus not found by local clamscan

2005-08-16 Thread Bart Silverstrim
On Aug 16, 2005, at 7:42 AM, Gian Carlo wrote: On Tue, Aug 16, 2005 at 12:35:29PM +0200, [EMAIL PROTECTED] wrote: Usually, they say it's not a good thing... Sorry, but I rather put it online then sending it into a mailing-list. Forgive me: maybe I was too purist. I realize there are

Re: [Clamav-users] What versions of Clamav for ppc platform

2005-08-04 Thread Bart Silverstrim
On Aug 3, 2005, at 3:45 PM, mailing by Giardina Software wrote: Hello list, i must install clamav on my machine; what stable stable version can i install for ppc platform?? PPC as in OS X? For that I'd use Fink to keep it up to date. ___

[Clamav-users] Amavis error with clamd

2005-06-27 Thread Bart Silverstrim
I just finished trying to upgrade ports on this FreeBSD system, and am getting an unusual error in the logs for Amavisd-new. Clam Antivirus-clamd: Error reading from /var/run/clamav/clamd: Resource temporarily unavailable at (eval 53) line 253, GEN8 line 1., retrying (2) Here's the clamd

Re: [Clamav-users] Amavis error with clamd

2005-06-27 Thread Bart Silverstrim
On Jun 27, 2005, at 2:33 PM, D.J. Fan wrote: I just finished trying to upgrade ports on this FreeBSD system, and am getting an unusual error in the logs for Amavisd-new. Clam Antivirus-clamd: Error reading from /var/run/clamav/clamd: Resource temporarily unavailable at (eval 53) line

Re: [Clamav-users] For those who submitted adware/spyware samples

2005-06-20 Thread Bart Silverstrim
On Jun 17, 2005, at 4:21 PM, Jim Popovitch wrote: On Fri, 2005-06-17 at 12:08 -0800, Matthew Schumacher wrote: IMHO, anything malicious sent though email should be detected by the virus scanner. I agree. What will it take for clamav to support all files/emails deemed malicious? A

Re: [Clamav-users] For those who submitted adware/spyware samples

2005-06-20 Thread Bart Silverstrim
On Jun 17, 2005, at 4:08 PM, Matthew Schumacher wrote: Kelson wrote: Niek wrote: If you want protection from ad- spyware, get anti-spyware software. I don't want to start up another flame war, but I really have to ask this question: Isn't email-borne spyware more in a virus scanner's

Re: [Clamav-users] ClamAV on Exchange 200x

2005-06-20 Thread Bart Silverstrim
On Jun 17, 2005, at 3:01 PM, Patrick Andry wrote: Does Exchange 2000 still accept mail for non-existent users, as it does for 5.5? Unless there's a feature/setting I'm missing, yes it does. ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] ClamAV on Exchange 200x

2005-06-17 Thread Bart Silverstrim
On Jun 16, 2005, at 4:37 PM, Robert G. Werner wrote: Roger Rustad wrote: Does anyone have any links to resources that deal with installing ClamAV on Exchange 200x servers? (Yes, I know that I can set up a ClamAV proxy; in this case, I want something I can install/do directly *on* the

Fwd: [Clamav-users] Re: which scans mail

2005-06-17 Thread Bart Silverstrim
Begin forwarded message: From: [EMAIL PROTECTED] Date: June 17, 2005 9:01:33 AM EDT To: clamav-users@lists.clamav.net Subject: [Clamav-users] Re: which scans mail Reply-To: ClamAV users ML clamav-users@lists.clamav.net I will be away from the office until Monday, June 27. If you need an

Re: [Clamav-users] Re: undetected malwares

2005-06-07 Thread Bart Silverstrim
On Jun 6, 2005, at 10:34 AM, Michel Arboi wrote: On 06/06/05, Tomasz Kojm [EMAIL PROTECTED] wrote: You're distributing malware, so you're bad. Clamav does not even catch half of the worms that are currently in the wild. Most of them are dangerous IRC bots. I was about to ask how I can help

Re: [Clamav-users] Re: undetected malwares

2005-06-07 Thread Bart Silverstrim
On Jun 6, 2005, at 11:22 AM, Matt Fretwell wrote: Michel Arboi wrote: You're distributing malware, so you're bad. Clamav does not even catch half of the worms that are currently in the wild. Most of them are dangerous IRC bots. I was about to ask how I can help the project. I will not. I

Re: [Clamav-users] Arrogance toward well-meaning participants (was: undetected malwares)

2005-06-07 Thread Bart Silverstrim
On Jun 6, 2005, at 11:56 AM, Niek wrote: On 6/6/2005 5:54 PM +0200, Kevin W. Gagel wrote: Tomasz, The best defence against such childish behaviour is to consider the source and not bother to respond. You're above such childish behaviour, the child is not. Don't bother responding to it...

Re: [Clamav-users] Arrogance toward well-meaning participants (was: undetected malwares)

2005-06-07 Thread Bart Silverstrim
On Jun 6, 2005, at 12:26 PM, Tomasz Kojm wrote: On Mon, 6 Jun 2005 17:51:35 +0200 Julian Mehnle [EMAIL PROTECTED] wrote: Tomasz Kojm wrote: Michel Arboi wrote: I was about to ask how I can help the project. I will not. I think that you don't need bad people. Good bye. You're a troll. Go

Re: [Clamav-users] 0.85.1 milter crashing alot

2005-06-07 Thread Bart Silverstrim
On Jun 6, 2005, at 9:49 PM, Carl Thompson wrote: I've had lots of problems with clamav-milter (running inet or .sock) crashing. I know that .82 didn't have issues like this and I would like to track them down and post any results I can find to possibly help the developers. Is there any

Re: [Clamav-users] Re: undetected malwares

2005-06-07 Thread Bart Silverstrim
On Jun 7, 2005, at 8:56 AM, Matt Fretwell wrote: Bart Silverstrim wrote: The devel's time is not infinite. I am sure most of them do have other jobs and things to do also. Do stop trolling and just ask them how to submit the virii :) ( No use being of a subtle disposition on this list

Re: [Clamav-users] Arrogance toward well-meaning participants (was: undetected malwares)

2005-06-07 Thread Bart Silverstrim
On Jun 7, 2005, at 9:00 AM, Matt Fretwell wrote: Bart Silverstrim wrote: If he already did and hadn't gotten feedback, maybe there could be some people who would coordinate some form of feedback system on whether a sample is in the works or in the queue or something like

Re: [Clamav-users] Re: undetected malwares

2005-06-07 Thread Bart Silverstrim
On Jun 7, 2005, at 9:46 AM, Matt Fretwell wrote: Bart Silverstrim wrote: My wife and I just had a newborn baby boy. The first and foremost thing to learn...tolerance. He cries because it's the only way he can communicate, it's frustrating because we have to interpret what he means

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 16, 2005, at 5:43 PM, Dennis Peterson wrote: Most of the spam I've gotten the last three days is from comcast.net. Apparently they allow their customers to send out to port 25. They should lock that down so that spam goes out through their own servers so they can feel the pain when they

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 2:17 AM, Alan Premselaar wrote: Jef Poskanzer wrote: ..snip... And finally, if you want to run a check on the HELO string, I find that just rejecting outside connections that claim a HELO of your own hostname gets rid of a very high proportion of crapmail. This very simple

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 8:48 AM, Dennis Peterson wrote: Bart Silverstrim said: To me, that price is learning how to do it right. Price isn't always monetary. I wouldn't argue with the idea of having to tell your provider that you need your particular connection unfiltered and leave it unfiltered

Re: [Clamav-users] Re: custom signature files

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 11:28 AM, Morgan Smith wrote: Jef Poskanzer wrote: Hey, has anyone made or run across a signature file that matches all windows executables and all archive formats? Seems like this would be fairly easy to create. --- Jef Jef Poskanzer [EMAIL PROTECTED]

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 12:17 PM, Matt Fretwell wrote: Bart Silverstrim wrote: Maybe even do a reverse check to see if there's a mail server on the sending system...how many systems would break doing a check like that? The sending server isn't guaranteed to be a MX, so any DNS MX or reverse

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 3:21 PM, [EMAIL PROTECTED] wrote: On Tue, 17 May 2005, Damian Menscher wrote: Would the person who implements this do me a favor and make the virus pretend to be a viagra spam? If we format the hard drives of people that buy from spammers, and the media picks up on it, then

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 3:39 PM, Dennis Peterson wrote: [EMAIL PROTECTED] said: For email transfer and MTA's alike, putting SPF in DNS to help authenticate the source is a step in the right direction. If SPF is a good idea, and it is dns based, then so should forward-and-back lookups. If additional

Re: [Clamav-users] sober.p, spf, dns, nazis, fruit-of-the-loom, lucky charms

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 5:35 PM, [EMAIL PROTECTED] wrote: perhaps it's time clamav-users be split into clamav-help and clamav-discussion. something like that maybe. but the list is sagging under the weight of all this metadiscussion. am i the only one growing weary of not just meta-discussion, but

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 4:03 PM, Bill Taroli wrote: Steffen Winther Soerensen wrote: This seems more like a discussion for another mailing list or a Usenet group on MTAs/SMTP IMHO I don't disagree... are there any good ones for SPF or similar debates? I do think -- much as you'd find in the Amavisd

Re: [Clamav-users] sober.p and german adverts?

2005-05-17 Thread Bart Silverstrim
On May 17, 2005, at 7:06 PM, Damian Menscher wrote: On Tue, 17 May 2005, Dennis Peterson wrote: Damian Menscher said: Since you are speaking for all of us what do we think of your 5 line sig? I bet some of us think it sux. As do I. But I think you'll agree it is about as dense as possible given

[Clamav-users] database number

2005-05-16 Thread Bart Silverstrim
What is the current database version from freshclam for people out there? I've been getting a huge number of bounces with german subjects, addressed to people with usernames beginning with 3d (just starting to investigate what is going on with this...) but the past few freshclam runs have

[Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
Some more info... I see in our amavis logs on our ClamAV system (postfix pre-filter FreeBSD for email) this kind of listing... /usr/local/sbin/amavisd[35705]: (35705-10) Blocked INFECTED (Worm.Sober.P), [EMAIL PROTECTED] - f-Ge2_bV@address snipped, Hits: -, tag=0, tag2=4, kill=4, L/0/0/0 That

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 9:00 AM, Mike Blonder wrote: I am also getting inundated with German gibberish spam. Would you mind explaining the significance (if any) of the email address that you posted? I am finding that the German Gibberish garbage is spoofing a different email address with each

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 9:59 AM, Mike Blonder wrote: OK. I think I get it. You had identified the oncbuv.com http://oncbuv.comaddress as a source for the sober.p garbage earlier and now it is showing up with the German gibberish garbage. Sort of. I can't find oncbuv.com so it's spoofed. The IP

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 10:52 AM, Rainer Zocholl wrote: [EMAIL PROTECTED](Bart Silverstrim) 16.05.05 08:51 Maybe you should have simply entered it into google? I'm quite sure that google would have lead you to the right place. Yes, google can search for german strings too! IMOH ;-) I did enter

Re: [Clamav-users] database number

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 10:51 AM, Rainer Zocholl wrote: [EMAIL PROTECTED](Bart Silverstrim) 16.05.05 08:27 What is the current database version from freshclam for people out there? It's always shown in the bottom line of http://www.clamav.net/ Latest database release is: main.cvd 31 daily.cvd 879

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 11:08 AM, Randal, Phil wrote: It's easy to block. Check the handler's Diary at http://isc.sans.org/ and follow the links. Thank you, that's my next task when I get a block of time today. Thanks again! ___

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 11:06 AM, Thomas Hochstein wrote: Bart Silverstrim schrieb: That address had been hammering us over and over for awhile with sober.p. Now it's become quiet. Yes. Now the infected hosts are sending out spam containing (very) right-wing political propaganda. Don't read German

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 1:41 PM, John Jolet wrote: This email, for instance was sent from a properly configured mta running antispam and antivirus scanning in BOTH directions, from a dynamic ip. If my wife sends email from her computer, it goes to the isp's mta, which does inbound only scanning.

Re: [Clamav-users] sober.p and german adverts?

2005-05-16 Thread Bart Silverstrim
On May 16, 2005, at 1:54 PM, Rainer Zocholl wrote: [EMAIL PROTECTED](Bart Silverstrim) 16.05.05 11:05 I did enter it in when I first discovered it, but there were no hits. Ok, next time mention it ;-) Here I thought it was common sense now! :-) Apparently it will be very hard to block if it's

Re: [Clamav-users] Maybe a virus Sober.P

2005-05-05 Thread Bart Silverstrim
On May 5, 2005, at 8:02 AM, Matt Fretwell wrote: Daniel J McDonald wrote: as it is harder to scan those messages for viruses Nonsense. Mail is mail. If you are running a mailserver, it should be able to cope with all types of mail, irrelevant of (creation|submission) method. But...if they're

Re: [Clamav-users] Maybe a virus Sober.P

2005-05-05 Thread Bart Silverstrim
On May 5, 2005, at 9:40 AM, Dennis Peterson wrote: Bart Silverstrim said: On May 5, 2005, at 8:02 AM, Matt Fretwell wrote: Daniel J McDonald wrote: as it is harder to scan those messages for viruses Nonsense. Mail is mail. If you are running a mailserver, it should be able to cope with all types

Re: [Clamav-users] Maybe a virus Sober.P

2005-05-05 Thread Bart Silverstrim
On May 5, 2005, at 10:45 AM, Matt Fretwell wrote: Bart Silverstrim wrote: My webmail is configured to use our standard smtp servers for all inbound/outbound mail. It really isn't all that difficult. My understanding was that we were talking about people accessing Yahoo or Hotmail from work

Re: [Clamav-users] Maybe a virus Sober.P

2005-05-05 Thread Bart Silverstrim
On May 5, 2005, at 2:38 PM, Matt Fretwell wrote: Bart Silverstrim wrote: This is actually two separate scenarios. That was Daniel's fault instigated by his being vague :) Now, a clever man would put the poison into his own goblet, because he would know that only a great fool would reach for what

Re: [Clamav-users] Maybe a virus Sober.P

2005-05-04 Thread Bart Silverstrim
On May 4, 2005, at 11:12 AM, Nigel Horne wrote: On Wednesday 04 May 2005 16:02, [EMAIL PROTECTED] wrote: . If you have received this communication in error, please notify me immediately by telephone or fax But you haven't given your telephone and fax number, so how can you expect anyone to do

Re: [Clamav-users] possible new virus?

2005-04-19 Thread Bart Silverstrim
On Apr 19, 2005, at 1:56 PM, Daniel J McDonald wrote: On Tue, 2005-04-19 at 11:52 -0600, lists wrote: How should I submit this to see if it is a virus? Make certain detectbrokenexecutable is enabled. Stupid question but I thought I might as well ask anyway...going in on my own system to enable

Re: [Clamav-users] possible new virus?

2005-04-19 Thread Bart Silverstrim
On Apr 19, 2005, at 2:24 PM, Kelson wrote: Bart Silverstrim wrote: Do I want to remove the hash before DisableDefaultScanOptions in order to get the snip sections to work? No. This was discussed yesterday. There are options that are enabled by default, and DisableDefaultOptions wipes those

Re: [Clamav-users] Can phishing be considered one kind of spam ?

2005-04-15 Thread Bart Silverstrim
On Apr 15, 2005, at 9:39 AM, Joanna Roman wrote: Can phishing be considered one kind of spam ? Please no...please please no ___ http://lurker.clamav.net/list/clamav-users.html

[Clamav-users] false hits

2005-04-15 Thread Bart Silverstrim
Hello all... Question...I recently tried booting up with the Ultimate Boot CD that included INSERT Linux as one of the images. I booted to INSERT, ran freshclam, then proceeded to scan a hard disk on which Windows 98 was installed. I had a number of hits showing up within the Windows/system

Re: [Clamav-users] false hits

2005-04-15 Thread Bart Silverstrim
On Apr 15, 2005, at 10:45 AM, BitFuzzy wrote: Bart Silverstrim wrote: I had a number of hits showing up within the Windows/system directory. Heh, didn't Norton detect windows as a virus at one time? I remember there was something that reported Windows as a virus. I thought it was some old AV

Re: [Clamav-users] false hits

2005-04-15 Thread Bart Silverstrim
On Apr 15, 2005, at 12:54 PM, Tomasz Kojm wrote: On Fri, 15 Apr 2005 09:53:11 -0400 Bart Silverstrim [EMAIL PROTECTED] wrote: Hello all... Question...I recently tried booting up with the Ultimate Boot CD that included INSERT Linux as one of the images. I booted to INSERT, ran freshclam

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 21, 2005, at 5:10 PM, Brian Morrison wrote: On Mon, 21 Mar 2005 20:06:02 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: Brian Morrison wrote: Julian Mehnle wrote: Probably more like: can we have 'technical-threats.cvd' and 'non-technical-threats.cvd' instead of

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 6:35 AM, Dennis Davis wrote: On Tue, 22 Mar 2005, Rob MacGregor wrote: From: Rob MacGregor [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 09:58:17 + Subject: Re: [Clamav-users] Report Phishing attacks? Reply-To: ClamAV users ML

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 4:58 AM, Rob MacGregor wrote: On Mon, 21 Mar 2005 17:01:48 -0400, Samuel Benzaquen [EMAIL PROTECTED] wrote: I can also say that they don't want to compete against commercial AV vendors as I have read here 2^32 times that we should use not _only_ clamav, but a list of AVs to

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 8:05 AM, Dennis Davis wrote: On Tue, 22 Mar 2005, Bart Silverstrim wrote: From: Bart Silverstrim [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Tue, 22 Mar 2005 07:40:18 -0500 Subject: Re: [Clamav-users] Report Phishing attacks? ... I believe

Re: [Clamav-users] Report Phishing attacks?

2005-03-22 Thread Bart Silverstrim
On Mar 22, 2005, at 9:43 AM, BitFuzzy wrote: Bart Silverstrim wrote: Personally, my gripe is that the product is called ClamAV. If it's expanding it's mission to protect people from everything called malware, I'd change the name to something that indicates it's a malware detector

Re: [Clamav-users] virus incident response?

2005-02-17 Thread Bart Silverstrim
On Feb 16, 2005, at 7:04 PM, John Madden wrote: In any case, Clam is a user supported project. ALL viruses are submitted by end users. So, the only way response will get any better is if you submit new viruses you receive that get by clam. It's not going to 'improve' any other way. Well,

Re: [Clamav-users] clamav on gateway + sniffer to intercept mail attachments

2005-02-16 Thread Bart Silverstrim
On Feb 16, 2005, at 3:13 PM, vaida bogdan wrote: Hy, I use postfix+mailscanner on my mail server to block a lot of virii comming from my internal network. I would like to implement a solution to block virii traffic on the internal gateway. The network looks like this: WIN- WIN- GW1-

Re: [Clamav-users] Very good (short) Article on New Technique by Virus Authors

2005-01-31 Thread Bart Silverstrim
On Jan 31, 2005, at 1:35 PM, Sam wrote: Came across this and thought many of you may enjoy it. http://www.eweek.com/article2/0,1759,1756636,00.asp? kc=ewnws013105dtx1k599 Is it better than the previous one I didn't think we'd ever see as working? Write virus email to random people with

Re: [Clamav-users] Phishing Questions

2005-01-27 Thread Bart Silverstrim
On Jan 27, 2005, at 10:25 AM, Damian Menscher wrote: There was a discussion about this several months ago. Unfortunately, many people (including part of the signature-generation team) are too dogmatic about their feelings that phishing is bad, so we should block it to look at it logically. Can

Re: [Clamav-users] Phishing Questions

2005-01-27 Thread Bart Silverstrim
On Jan 27, 2005, at 10:33 AM, Tomasz Kojm wrote: No problem. As a bonus we will create a signature for your domain name ;-) Just kidding! Honest! I'd NEVER think of having Windows thought of as a virus... :-) ___

Re: [Clamav-users] Phishing Questions

2005-01-27 Thread Bart Silverstrim
On Jan 27, 2005, at 11:29 AM, Tomasz Kojm wrote: On Thu, 27 Jan 2005 11:27:00 -0500 Adam Tauno Williams [EMAIL PROTECTED] wrote: Just my two cents - I agree with the other guy. CLAM should blocks virii and worms, and leave SPAM to something else. Just think of the Phishing IS NOT spam! Is that

Re: [Clamav-users] Good job ClamAV team!

2004-11-16 Thread Bart Silverstrim
On Nov 16, 2004, at 12:52 PM, Minica, Nelson (EDS) wrote: 1024 viruses blocked in the last month (after 152,000 emails blocked by RBL's,etc) 68 were phishing attacks my users appreciated not seeing Then SpamAssassin flagged 1500 and Mimedefang removed 1300 attachments Overlapping products and

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 8:26 AM, jef moskot wrote: On Mon, 15 Nov 2004, Trog wrote: For example, the last Bagle (or Bofra) outbreak simply sent an email to it's target victims, who then have to click on a link to download the Worm. According to your definition, that is a 'social' attack, and should

Re: [Clamav-users] ClamAV should not try to detect phishingandothersocial engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 10:40 AM, Dennis Skinner wrote: Julian Mehnle wrote: Besides, if mail servers started using SPF (or similar authentication techniques) to verify envelope sender addresses, whoever publishes SPF records for his domains would be Not to start another flame war, but I find it

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 11:14 AM, jef moskot wrote: On Mon, 15 Nov 2004, Bart Silverstrim wrote: I'd say leave it to the antispammers to hammer out, and to the people who focus on bayes filters... In my case, if Clam has a chance to see the phishing e-mail, the anti-spam tactics have already failed

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 11:48 AM, Julian Mehnle wrote: Matt [EMAIL PROTECTED] wrote: The problem is that, as yourself and others have mentioned, the distinction between the different categories are dependant upon personal interpretation. What one classes as social engineering, someone else may class

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 11:48 AM, Trog wrote: Not one of the Clam developers have proposed adding general spam detection to ClamAV. You're right. This was an idea being proposed, I thought...a suggestion. Isn't this something worth going over on a users list as discussion? Sorry if not... :-/

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 11:54 AM, Brian Morrison wrote: On Mon, 15 Nov 2004 17:48:35 +0100 in [EMAIL PROTECTED] Julian Mehnle [EMAIL PROTECTED] wrote: But there definitely is a distinction between technical attacks and social engineering attacks, even though they're somewhat overlapping. I can't see

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 12:25 PM, Chris Meadors wrote: On Mon, 2004-11-15 at 12:12 -0500, Bart Silverstrim wrote: If it's a bunch of flashy graphics telling you to visit a website for fantastic deals on hiding money from third world countries while getting fantastic mortgage rates on your pen1s

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 12:29 PM, Daniel J McDonald wrote: clamav kills bad things - that's good, and I'd like it to be able to continue to kill bad things in the same expedient manner that it has in the past. That's not entirely true. There are people who installed it on Windows and Windows still

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 12:32 PM, Dennis Skinner wrote: How little user interaction is required before it is considered a technical enough? Require the user to open the attachment? Require the user to pop their mail? Technically, most viruses these days are social engineered in some way. Unlike

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 12:43 PM, Matt wrote: If the standard database was segregated, some people would inevitably cock up their configs and run with partial protection. This can cause problems not only for themselves, but others, in the case of propogation. Whitelist all traffic you want to allow!

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 2:02 PM, jef moskot wrote: On Mon, 15 Nov 2004, Bart Silverstrim wrote: ...if you're going to start moving it into another direction, it may be best to fork that and leave the original recipe alone until the new direction... I think you're overstating what the ClamAV team

Re: [Clamav-users] ClamAV should not try to detect phishingandothersocial engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 2:41 PM, Ken Jones wrote: Phising poses a threat to your users. The line between malware and virus' is a very grey one. Phishing is a threat if they supply information. How do you stop people from voluntarily giving information over? Scan every mail for text or formatting

Re: [Clamav-users] ClamAV should not try to detect phishingandothersocial engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 4:27 PM, Dennis Skinner wrote: Dave Goodrich wrote: My preference has been stated. I would prefer SpamAssassin do the puzzle solving of message bodies, headers, URI lookups, message obfuscation, etc and let ClamAV do the signature matching of attachments. SA uses many more

Re: [Clamav-users] ClamAV should not try to detect phishingandothersocial engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 4:39 PM, Kevin W. Gagel wrote: If I could use a single package to virus scan, spam scan and protect my users and company against phishing attacks then I would gladly use it (provided of course it was reliable). If I could use one operating system free from most bugs and

Re: [Clamav-users] ClamAV should not try to detect phishing andothersocial engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 4:41 PM, [EMAIL PROTECTED] wrote: Bart Silverstrim wrote: I find it interesting though that I've yet to hear from anyone commenting on my proposal to create a filter that will extract and convert all emails into pure text, or reformat it so only certain things can get through

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 5:35 PM, Nigel Horne wrote: On Monday 15 Nov 2004 9:23 pm, Bart Silverstrim wrote: Since I don't know any of the developers You can find our names in .../AUTHORS. -Bart -Nigel Well...I still don't *KNOW* you :-) Nice to kinda sorta meet you though. You and the rest

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-15 Thread Bart Silverstrim
On Nov 15, 2004, at 4:44 PM, Dave Goodrich wrote: Bart Silverstrim wrote: I find it interesting though that I've yet to hear from anyone commenting on my proposal to create a filter that will extract and convert all emails into pure text, or reformat it so only certain things can get through

Re: [Clamav-users] ClamAV should not try to detect phishing and othersocial engineering attacks

2004-11-14 Thread Bart Silverstrim
On Nov 14, 2004, at 9:26 AM, Steve Basford wrote: since ClamAV reached v0.80, I am using it to scan and reject e-mail messages. Today I noticed that ClamAV also detects phishing attacks. Phishing is pure social engineering and poses no threat whatsoever in a technical sense. I'm certainly

Re: [Clamav-users] ClamAV should not try to detect phishing and othersocial engineering attacks

2004-11-14 Thread Bart Silverstrim
On Nov 14, 2004, at 9:32 AM, Joe Maimon wrote: Steve Basford wrote: since ClamAV reached v0.80, I am using it to scan and reject e-mail messages. Today I noticed that ClamAV also detects phishing attacks. Phishing is pure social engineering and poses no threat whatsoever in a technical sense.

Re: [Clamav-users] ClamAV should not try to detect phishing andother social engineering attacks

2004-11-14 Thread Bart Silverstrim
On Nov 14, 2004, at 10:01 AM, John Jolet wrote: On the issue of manually reviewing the mails to submitisn't this the purpose of the quarantine directory? When it detects a phishing malware, look at the file in the quarantine directory. I think he's thinking that this is more time and labor

Re: [Clamav-users] Old ClamAV workaround

2004-10-25 Thread Bart Silverstrim
On Oct 24, 2004, at 3:29 PM, Mark Adams wrote: Matt wrote: What's the worst that can happen? It fails to compile, and you still need to find a packaged version. You'll be no worse off than you are now. The worst that can happen? I descend once again into dependency hell and spend hours

Re: [Clamav-users] a beginner's question

2004-10-05 Thread Bart Silverstrim
On Oct 5, 2004, at 6:08 AM, gillian wrote: Thank you so much for your response, but boy, now I am confused. Are you saying I should be using amavis not clamav? This is the 2nd response with an amavis url in it. Amavis is a program that can work in conjunction with ClamAV. Most UNIX systems work

Re: [Clamav-users] ERROR: JPEG.Comment

2004-09-30 Thread Bart Silverstrim
On Sep 30, 2004, at 3:26 AM, Damian Menscher wrote: On Wed, 29 Sep 2004 [EMAIL PROTECTED] wrote: ... It's interesting that viruses are finally starting to implement what we were joking about in 1995 at high school... I'm impressed with how far we've come. Less than a year ago, I could most

Re: [Clamav-users] JPEG Vulnerability Question

2004-09-30 Thread Bart Silverstrim
On Sep 30, 2004, at 1:08 PM, ralf bosz wrote: I have just upgraded to the latest version of ClamAV that is said to be able to detect the new JPEG vulnerability. I'm using ClamAV with MailScanner to scan e-mail. How can I test to see if ClamAV is indeed detecting the JPEG exploit? Download an

Re: [Clamav-users] clamav 0.8 rc2 installation tentative on Mac OS X

2004-09-24 Thread Bart Silverstrim
On Sep 24, 2004, at 7:55 AM, Joël Brogniart wrote: Hi there. I'm trying to install clamav on an Apple XServer with Mac OS X 10.3.5 (and all updates today). My first try is with september 2003 dev tools installer. A second try with XCode Tools 1.5 gave the same result. The third gave better

Re: [Clamav-users] Re: Re: Windows port ?

2004-09-22 Thread Bart Silverstrim
On Sep 22, 2004, at 5:33 AM, Ralph Angenendt wrote: He has to link the database *somehow* into his program. Look up what the GPL has to say about that. And: Hey, if you do not like the license of a program - do not use it. It is simple as that. If you want to use it - fulfill the license. I think

Re: [Clamav-users] Re: Re: Re: Windows port ?

2004-09-22 Thread Bart Silverstrim
On Sep 22, 2004, at 12:01 PM, Brian Bruns wrote: Security through obsecurity... How comforting. Misguided yet implemented by so many... Either use the DB as the authors tell you you can use it, or don't use it at all. It is very simple to understand. How would you like it if you were the ones

  1   2   >