Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Nigel Horne
On Tue, 2006-11-28 at 20:27 +0100, Per Jessen wrote: Dennis Peterson wrote: And the point is you don't have to come to harm if a phishing pattern is not available. That depends on your expectations. If you're purely using it for your own personal protection, you're absolutely right.

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Nigel Horne
On Tue, 2006-11-28 at 15:05 -0500, Gerard Seibert wrote: On Tuesday November 28, 2006 at 02:13:29 (PM) Per Jessen wrote: Quick additional comment - I used to use the very same argument, but experience and age have taught me that people are stupid. I would not say that. Perhaps

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Gerard Seibert
On Wednesday November 29, 2006 at 04:17:30 (AM) Nigel Horne wrote: On Tue, 2006-11-28 at 15:05 -0500, Gerard Seibert wrote: On Tuesday November 28, 2006 at 02:13:29 (PM) Per Jessen wrote: Quick additional comment - I used to use the very same argument, but experience and age have

[Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Ian Abbott
On 28/11/2006 19:06, Chris Purves wrote: Ian Abbott wrote: On 27/11/2006 23:32, Chris Purves wrote: I have tried cat filelist | xargs clamscan This works, except that xarg can only pass about 200 filenames to clamscan at a time. So for a filelist containing 1000 filenames clamscan will be

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Nigel Horne
On Wed, 2006-11-29 at 05:37 -0500, Gerard Seibert wrote: On Wednesday November 29, 2006 at 04:17:30 (AM) Nigel Horne wrote: On Tue, 2006-11-28 at 15:05 -0500, Gerard Seibert wrote: On Tuesday November 28, 2006 at 02:13:29 (PM) Per Jessen wrote: Quick additional comment - I used to

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Per Jessen
Nigel Horne wrote: Use the experimental code, then. It does a good job at catching phishes that aren't even in the database. OK, that sounds interesting, I'll take a look. /Per Jessen, Zürich ___ Help us build a comprehensive ClamAV guide: visit

[Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Virgo Pärna
On Tue, 28 Nov 2006 12:25:14 -0800, Dennis Peterson [EMAIL PROTECTED] wrote: Chris Purves wrote: /tmp/clamscan/*' I get the following error: /usr/bin/clamscan: Argument list too long This sounds like the command line limit for the OS. The list is quite large at 5000 - for that it would

Re: [Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Dennis Peterson
Virgo Pärna wrote: On Tue, 28 Nov 2006 12:25:14 -0800, Dennis Peterson [EMAIL PROTECTED] wrote: Chris Purves wrote: /tmp/clamscan/*' I get the following error: /usr/bin/clamscan: Argument list too long This sounds like the command line limit for the OS. The list is quite large at 5000 - for

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Adam Stephens
On Tue, 28 Nov 2006, Dennis Peterson wrote: Per Jessen wrote: This is not really complaint, perhaps just an observation. On 25/11 around 1000CET I submitted a sample and again on 26/11 also around 1000 I submitted a second sample - both phishing. I've only just today around 1800CET received

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Dennis Peterson
Adam Stephens wrote: On Tue, 28 Nov 2006, Dennis Peterson wrote: Per Jessen wrote: This is not really complaint, perhaps just an observation. On 25/11 around 1000CET I submitted a sample and again on 26/11 also around 1000 I submitted a second sample - both phishing. I've only just today

RE: [Clamav-users] How to run clamscan for a list of files from afile?

2006-11-29 Thread Mark
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dennis Peterson Sent: dinsdag 28 november 2006 22:58 To: ClamAV users ML Subject: Re: [Clamav-users] How to run clamscan for a list of files from afile? First of all, when it comes to scanning mail,

Re: [Clamav-users] How to run clamscan for a list of files from afile?

2006-11-29 Thread Dennis Peterson
Mark wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dennis Peterson Sent: dinsdag 28 november 2006 22:58 To: ClamAV users ML Subject: Re: [Clamav-users] How to run clamscan for a list of files from afile? First of all, when it comes to scanning

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread JamesDR
Dennis Peterson wrote: Adam Stephens wrote: On Tue, 28 Nov 2006, Dennis Peterson wrote: Per Jessen wrote: This is not really complaint, perhaps just an observation. On 25/11 around 1000CET I submitted a sample and again on 26/11 also around 1000 I submitted a second sample - both phishing.

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Dennis Davis
On Wed, 29 Nov 2006, Dennis Peterson wrote: From: Dennis Peterson [EMAIL PROTECTED] To: ClamAV users ML clamav-users@lists.clamav.net Date: Wed, 29 Nov 2006 07:46:17 -0800 Subject: Re: [Clamav-users] submit-to-publish time much too long for phishing Reply-To: ClamAV users ML

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Dennis Peterson
JamesDR wrote: Dennis Peterson wrote: Adam Stephens wrote: On Tue, 28 Nov 2006, Dennis Peterson wrote: Per Jessen wrote: This is not really complaint, perhaps just an observation. On 25/11 around 1000CET I submitted a sample and again on 26/11 also around 1000 I submitted a second sample -

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread JamesDR
Dennis Peterson wrote: JamesDR wrote: Dennis Peterson wrote: Adam Stephens wrote: On Tue, 28 Nov 2006, Dennis Peterson wrote: Per Jessen wrote: This is not really complaint, perhaps just an observation. On 25/11 around 1000CET I submitted a sample and again on 26/11 also around 1000 I

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread Dennis Peterson
JamesDR wrote: Dennis Peterson wrote: JamesDR wrote: I've found clam to be reactive to phishs, I've found SpamAssassin to be proactive... How does it do this? Proactive may not be the best word here, but since it uses regex and several rules applied to an email, it isn't reliant upon

Re: [Clamav-users] submit-to-publish time much too long for phishing

2006-11-29 Thread jef moskot
On Wed, 29 Nov 2006, JamesDR wrote: ...if your users are being let down by the 'time it takes to get a phish sig' then isn't about time their network/mail admin looked into added levels of detection? I think the original point was that if Clam is going to scan for phishing at all, the response

Re: [Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Bill Landry
Dennis Peterson wrote the following on 11/29/2006 7:23 AM -0800: Virgo Pärna wrote: On Tue, 28 Nov 2006 12:25:14 -0800, Dennis Peterson [EMAIL PROTECTED] wrote: Chris Purves wrote: /tmp/clamscan/*' I get the following error: /usr/bin/clamscan: Argument list too long This sounds like the

Re: [Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Dennis Peterson
Bill Landry wrote: Dennis Peterson wrote the following on 11/29/2006 7:23 AM -0800: One other option was to run a second instance of clamd pointed to a different config file and run the second instance as root. Then clamdscan should be able to scan all files in all directories without

Re: [Clamav-users] Choosing best MaxThreads value for clamd?

2006-11-29 Thread Daniel T. Staal
On Tue, November 28, 2006 10:53 pm, Tom Samplonius said: How do you choose the best MaxThreads value for a dedicated mail server? Should MaxThreads be each to double the number of cores, or something like that? What happens if MaxThreads is set too high? Too low? The main advice I've

Re: [Clamav-users] Choosing best MaxThreads value for clamd?

2006-11-29 Thread Tom Samplonius
- Daniel T. Staal [EMAIL PROTECTED] wrote: On Tue, November 28, 2006 10:53 pm, Tom Samplonius said: How do you choose the best MaxThreads value for a dedicated mail server? Should MaxThreads be each to double the number of cores, or something like that? What happens if

Re: [Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Tomasz Papszun
On Wed, 29 Nov 2006 at 12:37:35 -0800, Dennis Peterson wrote: Bill Landry wrote: Dennis Peterson wrote the following on 11/29/2006 7:23 AM -0800: One other option was to run a second instance of clamd pointed to a different config file and run the second instance as root. Then clamdscan

Re: [Clamav-users] Re: How to run clamscan for a list of files from a file?

2006-11-29 Thread Dennis Peterson
Tomasz Papszun wrote: [ clamdscan _did_ find the infected file! Because: ] $ grep -i sym /etc/clamav/clamd.conf FollowFileSymlinks So I believe (I haven't verified that empirically) that after creating in a directory of choice, symlinks to files to scan, there should be no need to split