Re: [Clamav-users] Independent Testing

2004-10-21 Thread sam wun
Julio Canto wrote: Bill Randle wrote: Dave P wrote: Are there any independent tests out there that do not paint such a bleak picture? Are there any plans to submit ClamAV or ClamWin to Virus Bulletin? [...] I think a better test is side-by-side comparisons with standard, commercial, products. If

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Julio Canto
sam wun wrote: Hi, how do you make ClamAV update virus database as soon as possible when the signature becomes ready? Sam. Polling frequently the online versions. This subject were allready discussed in the list some months ago. -- Regards, Julio Canto Hispasec Sistemas

Re: [Clamav-users] Where is signature db file

2004-10-21 Thread Odhiambo Washington
* sam wun [EMAIL PROTECTED] [20041021 03:43]: wrote: Dear Clamav experts, I just have a fresh clamav installed in FreeBSD 5.3 system. I have a hard time to allocate the signature database in the system. The following commandline have been using for update the signature: clamav 15245

Re: [Clamav-users] Where is signature db file

2004-10-21 Thread sam wun
Odhiambo Washington wrote: * sam wun [EMAIL PROTECTED] [20041021 03:43]: wrote: Dear Clamav experts, I just have a fresh clamav installed in FreeBSD 5.3 system. I have a hard time to allocate the signature database in the system. The following commandline have been using for update

Re: [Clamav-users] buglet in how clamdscan reports perm issues

2004-10-21 Thread Awie
Keep up the good work guys - ClamAV is superb!!! This means QS will continue support ClamAV, right. :D Thx Rgds, Awie ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Niek
On 10/21/2004 1:21 AM +0200, Dave P wrote: I am trying to convince my company to switch to open source where possible. It is much easier if the software has been evaluated by an independent group. Unfortunately, reviews that I could find, including GMX Systematic and Heise magazines, were

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Bogusaw Brandys
Hi Niek wrote: On 10/21/2004 1:21 AM +0200, Dave P wrote: I am trying to convince my company to switch to open source where possible. It is much easier if the software has been evaluated by an independent group. Unfortunately, reviews that I could find, including GMX Systematic and Heise

Re: [Clamav-users] Independent Testing

2004-10-21 Thread Jason Haar
On Thu, Oct 21, 2004 at 09:38:49AM +0200, Bogusaw Brandys wrote: Right.Put ClamAV on front and commercial scanner on back ;-) ClamAV do not recognize many polymorphic malwares, but today there are not so many such malwares ;-) Too right - that describes exactly how Qmail-Scanner utilizes

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Trog
On Wed, 2004-10-20 at 16:33, Grant Supp wrote: It seems to happen when scanning the same files. Untitled Attachment seems to cause the problem evey time. I think this attachment might be generated by Outlook 2003 when assigning a task to a user, although I'm not sure, since I don't have a

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Trog
On Wed, 2004-10-20 at 20:25, Rob Dueckman wrote: I'm running mimedefang/spamassassin/clamav on an IRIX 6.5 machine and have found that some files cause both clamd and clamscan to core. Since I'm still running this combo, I can't forward the message to the list, but it can be found at:

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Andy Fiddaman
; On Wed, 2004-10-20 at 16:33, Grant Supp wrote: ; ; It seems to happen when scanning the same files. Untitled Attachment seems to cause the problem evey time. I think this attachment might be generated by Outlook 2003 when assigning a task to a user, although I'm not sure, since I don't have a

RE: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Nigel Horne
[mailto:[EMAIL PROTECTED] Behalf Of Trog $ gdb clamscan (gdb) run /path/to/message.txt (wait for seg fault) (gdb) bt Before doing that it would help to rebuild from source using the -g option. -trog -Nigel ___

[Clamav-users] Re: GDI+ bug exploit Mutations

2004-10-21 Thread Virgo Prna
On Mon, 18 Oct 2004 15:01:46 + (UTC), Virgo Pärna wrote: dragon:~/soft/clamav clamscan -r -i --no-summary clamav-0.80.tar.gz clamav-0.80.tar.gz: Exploit.JPEG.Comment.E9 FOUND I forget to to post immediatly - it didn'd happen anymore on Tuesday. So, the updated signatures fixed it.

[Clamav-users] manipulated and encrypted zip files

2004-10-21 Thread Alexander Harkenthal
Hello all, I tested my clamd version 0.80-1 which I use on my mail server with manipulated zip files as I read some warnings in some news regarding this issue. Clamd didn't find the virus in a zip file where the zip file information is manipulated. The global information in this zip file

Re: [Clamav-users] manipulated and encrypted zip files

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 14:37:09 +0200 Alexander Harkenthal [EMAIL PROTECTED] wrote: Clamd didn't find the virus in a zip file where the zip file information is manipulated. The global information in this zip file about the size of the file was set to 0 Byte. We are aware of the problem and are

[Clamav-users] Clamav 0.80 with daemontools ?

2004-10-21 Thread Forexys Support Center
Hii have a small problems with the 0.80 version ... he don't want start correctly..I have:6616 ? S 0:00 \_ supervise clamd6707 ? Z 0:00 | \_ [run] defunct6617 ? S 0:00 \_ supervise log6618 ? S 0:00 \_ /usr/bin/multilog t s100 n20 /var/log/clamav6706 ? S 0:00 /usr/sbin/clamd Why

[Clamav-users] .80 Compile failure (SUSE 9.0 Pro AMD64)

2004-10-21 Thread Chris Wood
In trying to compile .80 on SUSE 9.0 Pro AMD64, I get two errors. In the archives I noticed someone with the same problem back in April but he never solved it. The first error is 'make' complains about libgmp. I do have libgmp in /lib64 but not in /lib. I assume I should be able to compile

[Clamav-users] Please explain ?

2004-10-21 Thread Bogusaw Brandys
Hello, Could someone explain why there are sometimes a few signatures for one malware ? Does it mean that malware has small change and that are MD5 signatures ? Today was for example submission of HTML.Phishing.Auction-1 HTML.Phishing.Auction-2 HTML.Phishing.Bank-5

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Trog
On Thu, 2004-10-21 at 14:48, Bogusaw Brandys wrote: Hello, Could someone explain why there are sometimes a few signatures for one malware ? Does it mean that malware has small change and that are MD5 signatures ? Well, it depends what the signature is for. Today was for example

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 15:23:35 +0100 Trog [EMAIL PROTECTED] wrote: Occasionally you'll see sigs like Worm.Bagle.AG.2, which may be a second signature to match a different instance of the same malware. For example re-packed with a packer we don't support at the moment. -- oo.

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Bogusaw Brandys
Trog wrote: On Thu, 2004-10-21 at 14:48, Bogusaw Brandys wrote: Hello, Could someone explain why there are sometimes a few signatures for one malware ? Does it mean that malware has small change and that are MD5 signatures ? Well, it depends what the signature is for. Today was for example

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 16:41:23 +0200 Bogus³aw Brandys [EMAIL PROTECTED] wrote: These are different signatures (non MD5 in this case) for different instances of phishing emails. So I wouldn't really call that malware. So it is harmless ? Well, that depends on an intelligence of a

Re: [Clamav-users] Clamav 0.80 with daemontools ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 08:25 am, Forexys Support Center wrote: Hi i have a small problems with the 0.80 version ... he don't want start correctly.. I have: 6616 ?S 0:00 \_ supervise clamd 6707 ?Z 0:00 | \_ [run] defunct 6617 ?S 0:00 \_

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 09:46 am, Tomasz Kojm wrote: On Thu, 21 Oct 2004 16:41:23 +0200 Bogus³aw Brandys [EMAIL PROTECTED] wrote: These are different signatures (non MD5 in this case) for different instances of phishing emails. So I wouldn't really call that malware. So it is

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Bogusaw Brandys
Jeremy Kitchen wrote: On Thursday 21 October 2004 09:46 am, Tomasz Kojm wrote: On Thu, 21 Oct 2004 16:41:23 +0200 Bogusaw Brandys [EMAIL PROTECTED] wrote: These are different signatures (non MD5 in this case) for different instances of phishing emails. So I wouldn't really call that malware. So it

[Clamav-users] rld: Error:

2004-10-21 Thread Dale Bohl
Any help will be greatly appreciated on this. I'm on IRIX 6.5.15m - MIPS and trying to install ClamAV 0.75 but cannot. I have installed 0.75 on IRIX 6/5/24m without any issues. The ./configure results are attached. The make and make install went fine. When running /usr/local/bin/freshclam I see

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Trog
On Thu, 2004-10-21 at 16:09, Bogusaw Brandys wrote: I must ask.I have many spam messages in my email folder. Do I consider sending them as a submission ? Should people know what are the differences , to stop submit just junk emails? Or it is accepted ? No. Definitely not. I get over 200

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 17:09:20 +0200 Bogus³aw Brandys [EMAIL PROTECTED] wrote: I must ask.I have many spam messages in my email folder. Do I consider sending them as a submission ? Should people know what are the No, we all have billions of them. -- oo. Tomasz Kojm [EMAIL

Re: [Clamav-users] rld: Error:

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 10:01:23 -0500 Dale Bohl [EMAIL PROTECTED] wrote: Any help will be greatly appreciated on this. I'm on IRIX 6.5.15m - MIPS and trying to install ClamAV 0.75 but cannot. I have installed 0.75 on IRIX 6/5/24m without any issues. 0.75 is no longer supported. Please try to

Re: [Clamav-users] Please explain ?

2004-10-21 Thread Jeremy Kitchen
On Thursday 21 October 2004 10:09 am, Bogusaw Brandys wrote: I must ask.I have many spam messages in my email folder. Do I consider sending them as a submission ? Should people know what are the differences , to stop submit just junk emails? Or it is accepted ?

update as soon as possible WAS RE: [Clamav-users] Independent Testing

2004-10-21 Thread Mitch (WebCob)
Hi, how do you make ClamAV update virus database as soon as possible when the signature becomes ready? Sam. [Mitch (bitblock)] Sam. Bad toad! Don't hijack threads. You can run freshclam - there is no such thing as an instant update - the latest version uses DNS records to allow more

[Clamav-users] RE: update as soon as possible

2004-10-21 Thread Matthew.van.Eerde
Mitch (WebCob) wrote: Hi, how do you make ClamAV update virus database as soon as possible when the signature becomes ready? Sam. [Mitch (bitblock)] Sam. Bad toad! Don't hijack threads. You can run freshclam - there is no such thing as an instant update - the latest version uses DNS

[Clamav-users] Re: rld: Error:

2004-10-21 Thread Dale Bohl
Tomasz Kojm wrote: On Thu, 21 Oct 2004 10:01:23 -0500 Dale Bohl [EMAIL PROTECTED] wrote: Any help will be greatly appreciated on this. I'm on IRIX 6.5.15m - MIPS and trying to install ClamAV 0.75 but cannot. I have installed 0.75 on IRIX 6/5/24m without any issues. 0.75 is no longer supported.

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Rob Dueckman
Uggg... I've pulled the latest gdb down and built it. It builds OK, but it won't work properly (complains with the message warning: Signal ? does not exist on this system. and just sits spinning) SGI's dbx isn't much help either (and I really don't know how to use it :-) I think I'll have to

Re: [Clamav-users] clamd/clamscan core on some files under IRIX

2004-10-21 Thread Damian Menscher
On Wed, 20 Oct 2004, Rob Dueckman wrote: I'm running mimedefang/spamassassin/clamav on an IRIX 6.5 machine and have found that some files cause both clamd and clamscan to core. Since I'm still running this combo, I can't forward the message to the list, but it can be found at:

Re: [Clamav-users] Re: rld: Error:

2004-10-21 Thread Tomasz Kojm
On Thu, 21 Oct 2004 14:28:58 -0500 Dale Bohl [EMAIL PROTECTED] wrote: /home/cheetah/dbohl/proj/hsm/terabyte: OK /home/cheetah/dbohl/proj/hsm/archiving: OK /home/cheetah/dbohl/proj/uit/home_links_reasons: OK LibClamAV Error: Can't create temporary file : No such file or directory Memory

Re: [Clamav-users] Unable to open file or directory ERROR

2004-10-21 Thread Grant Supp
Andy Fiddaman wrote: I'm not a developer but this looks similar to what I'm seeing on Solaris. Is readdir_r in use here ? (grep READDIR_R clamav-config.h) Can you post the dirent struct from your /usr/include/sys/dirent.h file ? Otherwise the following command should give enough: find

Re: [Clamav-users] Independent Testing (with STATS!)

2004-10-21 Thread clamav
Are there any independent tests out there that do not paint such a bleak picture? Are there any plans to submit ClamAV or ClamWin to Virus Bulletin? Want stats? We employ clam, uvscan (McAfee/NAI) and bdc. Clam is much faster because of clamd so it is first. Here is the breakdown in order

[Clamav-users] Re: freshclam: 'Broken or not a CVD file'

2004-10-21 Thread Tim Boyer
On Thu, 14 Oct 2004 01:21:47 +0100, Matt [EMAIL PROTECTED] wrote: Tim Boyer wrote: Downloading daily.cvd [*] ERROR: Verification: Broken or not a CVD file Giving up... I went to rc4 last night in the hope that it would be fixed, but I'm getting the same error. This is answered in the