Re: [clamav-users] winnow FP

2016-04-14 Thread Paul Whelan
On 13 Apr 2016 at 11:20, Alex wrote: > Hi, > > I don't understand why themastersbaker.com would be tagged? > > # sigtool --find-sigs winnow.spam.ts.untyped.966134 | sigtool --decode-sigs > VIRUS NAME: winnow.spam.ts.untyped.966134 Winnow signatures are distributed by Sanesecurity.com. They

Re: [clamav-users] 0.98 and PUA

2013-09-30 Thread Paul Whelan
On 30 Sep 2013 at 11:03, Martin Hepworth wrote: Thanks was looking at the PUA page on the main www site and it's still got the 2007 advice of here be monsters tread carefully ;-) I use them but Alain Zidouemba from Sourcefire replied to a question in March 2013 about a PUA type that didn't

Re: [clamav-users] news: Cisco Announces Agreement to Acquire Sourcefire

2013-07-24 Thread Paul Whelan
On 24 Jul 2013 at 10:07, Joel Esler wrote: http://blog.clamav.net/2013/07/a-continued-commitment-to-open-source.h tml Hopefully this will help out :) Time will tell. paul ___ Help us build a comprehensive ClamAV guide: visit

Re: [clamav-users] GTUBE message detection

2013-04-10 Thread Paul Whelan
On 9 Apr 2013 at 11:12, Steve Basford wrote: Hi All, Couple of updates.. I've just check end the Sanesecurity.TestSig.GTUBE signature name had accidentally been renamed to Sanesecurity.TestSig.10616 I have, however, removed the checks for GTUBE, so at least ClamAV and Third-Party

[clamav-users] PUA types

2013-03-22 Thread Paul Whelan
What PUA category does PUA.OLE.EmbeddedPDF come under? (Triggered by a Word document). paul ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

Re: [clamav-users] PUA types

2013-03-22 Thread Paul Whelan
On 22 Mar 2013 at 11:12, Alain Zidouemba wrote: Paul, That alert is to indicate that the file it alerted on is a likely an MS Office document that has a PDF embedded within it. You may want to take a closer look to it as we have observed malicious payloads being distributed this way in the

Re: [clamav-users] how to run clamav through command prompt in windows OS

2013-01-31 Thread Paul Whelan
On 29 Jan 2013 at 12:26, naresh n wrote: Please can any body tell me is it possible to run calmav through command prompt in windows OS? If yes how to run? 1. Download install the windows binaries from http://sourceforge.net/projects/clamav/files/clamav/win32/ 2. Read the documentation and

Re: [clamav-users] Windows versions of ClamAV 0.97.6 posted!

2012-09-19 Thread Paul Whelan
On 18 Sep 2012 at 16:55, Joel Esler wrote: All: if you are a Windows user of ClamAV, you'll be happy to know that we have released the Windows builds for ClamAV 0.97.6 to our Sourceforge site here: http://sourceforge.net/projects/clamav/files/clamav/win32/0.97.6/ Please feel free to

Re: [clamav-users] Windows versions of ClamAV 0.97.6 posted!

2012-09-19 Thread Paul Whelan
On 19 Sep 2012 at 15:19, Shawn Webb wrote: Paul, As of 0.97.5, we do not generate CAB or ZIP files for binary builds. The last published ZIP file was for 0.97.4 and is located on Sourcefore. Since MSI files can be extracted, we haven't provided CAB/ZIP files. OK, understood - it just means

Re: [clamav-users] [Clm-u] Windows packaging

2012-06-25 Thread Paul Whelan
On 25 Jun 2012 at 8:13, Steve Basford wrote: Your best bet is to ask on the ClamWin forum. Here is the forum site http://forums.clamwin.com/ I'm not sure if he's talking about the binaries here, auto-built by ClamAV Team (not the version by the ClamWin team)

Re: [clamav-users] Windows packaging

2012-06-25 Thread Paul Whelan
On 25 Jun 2012 at 9:55, Tom Judge wrote: Hi Paul, On 24/06/2012 18:15, Paul Whelan wrote: What's the reason for the change in the packaging of the windows binaries? The windows binaries where packaged with custom shell script before, now they are packaged by VisualStudio when we

[clamav-users] Windows packaging

2012-06-24 Thread Paul Whelan
What's the reason for the change in the packaging of the windows binaries? The differences include: Creation of a msi install in place of the previously zipped executables and libraries Exclusion of the necessary msvc* runtime libraries Inclusion of the previously separate libclamunrar libs

[clamav-users] List delays

2012-05-25 Thread Paul Whelan
Is this 12 week delay down to a scanning problem? From list message received today: Received: from tad.clamav.net (localhost.localdomain [127.0.0.1]) by tad.clamav.net (Postfix) with ESMTP id DFAD416C1A6; Fri, 25 May 2012 14:37:23 +0200 (CEST) X-Original-To: clamav-us...@tad.clamav.net

Re: [Clamav-users] Mirror problem?

2010-05-05 Thread Paul Whelan
On 5 May 2010 at 9:02, Jason Bertoch wrote: On 2010/05/04 12:56 PM, Jason Bertoch wrote: On 2010/05/04 12:00 PM, Alan Stern wrote: I've been getting messages like this: main.cld is up to date (version: 52, sigs: 704727, f-level: 44, builder: sven) Trying host db.local.clamav.net

Re: [Clamav-users] ClamAV on Windows Server 2003

2010-04-20 Thread Paul Whelan
On 20 Apr 2010 at 9:50, tim.had...@bl.uk wrote: Does anyone know if there is still a Windows compilation which will run on Windows Server 2003 SP2? ClamAV (clam-latest-32.exe) refuses to install on this operating system and ClamWin seems to have mutated into a desktop product which lacks

Re: [Clamav-users] The EOL tweets

2010-04-19 Thread Paul Whelan
On 19 Apr 2010 at 16:17, Tommaso Basilici wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm probably not fitting in the right place of the thread but I just signed in and could not know where to start. Our only big problem with this upgrade is that the actual debian stable (lenny)

Re: [Clamav-users] Out of Memory

2010-03-16 Thread Paul Whelan
On 12 Mar 2010 at 8:23, jeff donovan wrote: I ran into a similar problem. It turned out to be AutoWhitelist growing eating up Hardrive space, eventually the OS had no room for virtual memory. see; /var/clamav/.spamassassin/autowhitelist Thanks for the reply, but no spamassassin here.

Re: [Clamav-users] Out of Memory

2010-03-12 Thread Paul Whelan
On 11 Mar 2010 at 11:09, Jim Preston wrote: On Mar 11, 2010, at 10:49 AM, Paul Whelan wrote: On 11 Mar 2010 at 14:32, Matus UHLAR - fantomas wrote: On 11.03.10 11:24, Paul Whelan wrote: I'm getting occasional OOM faults apparently originating from clamd on debian. OOM

[Clamav-users] Out of Memory

2010-03-11 Thread Paul Whelan
I'm getting occasional OOM faults apparently originating from clamd on debian. Is there a simple way to track down why these are happening and preventing them? Top never shows any problems, and the machine is very lightly loaded. Message log begins: Mar 3 21:18:27 rose kernel: clamd invoked

Re: [Clamav-users] Out of Memory

2010-03-11 Thread Paul Whelan
On 11 Mar 2010 at 14:32, Matus UHLAR - fantomas wrote: On 11.03.10 11:24, Paul Whelan wrote: I'm getting occasional OOM faults apparently originating from clamd on debian. OOM means out of memory. Either you are low on real/virtual memory, or you have memory leak somewhere. Check your

Re: [Clamav-users] ClamAV and VirusTotal

2009-03-19 Thread Paul Whelan
On 18 Mar 2009 at 6:55, Julio Canto wrote: Hi again, You're wrong assuming that, therefore you should not accuse us of using 'strange official channels'. All engines and parameters used - including the ones from ClamAV - at VirusTotal are decided and provided with the vendors involved.

Re: [Clamav-users] ClamAV and VirusTotal

2009-03-18 Thread Paul Whelan
On 17 Mar 2009 at 21:22, Tomasz Kojm wrote: out of the box windows support is planned for ClamAV 0.96; in general we don't distribute any binaries but we may consider doing this for windows when the support is mature enough Thanks for the update. paul

Re: [Clamav-users] ClamAV and VirusTotal

2009-03-17 Thread Paul Whelan
On 17 Mar 2009 at 13:28, Julio Canto wrote: Steve Basford escribió: Any particular reason why they are using 0.94.1 (and it appears with the most non aggressive settings)? You are not showing off your best side... Having said that... 0.94.2 is available for windows: Hi there, We

Re: [Clamav-users] [0.0] Re: simplest replacement for ancient amavis-perl

2008-08-12 Thread Paul Whelan
On 12 Aug 2008 at 7:57, Charles Gregory wrote: On Mon, 11 Aug 2008, Dennis Peterson wrote: . A problem I've seen with greylisting is the round-robin MTA pool. Each is told in turn to come back later and if the pool is large it can take a long time to cycle through all of them. I

Re: [Clamav-users] ClamAV crash - too many signatures?

2008-02-22 Thread Paul Whelan
On 22 Feb 2008 at 7:16, Gerard wrote: clamd reports: 249417 freshclam reports: 169676 That's main only. daily is 48000 now, giving freshclam total about 218000. With just Sanesesecurity the total is 232000 and not caused me any issues on 4 servers. The difference with your total