[Clamav-users] Worm.Sober.I

2004-11-19 Thread Filbert
Update 593: Added: Worm.Sober.I Great job Clamav team. You were the first (once again). Sober's are coming fast now. Thanks. -- .Filb ___ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users

[Clamav-users] ClamAV UPX support ?

2004-11-19 Thread Nicolas Joly
Hi, I just made some expermients with ClamAv (0.80 and CVS) and the recent Worm.Sober.I on my NetBSD/amd64 workstation, and noticed strange results about UPX support. [EMAIL PROTECTED] [virus/xx] clamscan -V ClamAV devel-20041119/594/Fri Nov 19 11:06:44 2004 [EMAIL PROTECTED] [virus/xx

[Clamav-users] freshclam problem

2004-11-19 Thread David Green
I figure that this has been covered before, but I couldn't fin it in the archives. I have clamav installed on a Apple XServe running OS X Server 10.3.6. After installation, I get this message every hour: Subject: Cron [EMAIL PROTECTED]> /usr/local/bin/freshclam --quiet --daemon-notify -l

Re: [Clamav-users] ClamAV UPX support ?

2004-11-19 Thread Tomasz Kojm
ClamAV devel-20041119/594/Fri Nov 19 11:06:44 2004 [EMAIL PROTECTED] [virus/xx] clamscan --no-summary spidernet.scr spidernet.scr: Worm.Sober.I FOUND But when i try to unpack the worm with `upx', clamscan de not report an infected file anymore : The Worm.Sober.I signature has been created against

Re: [Clamav-users] freshclam problem

2004-11-19 Thread Tomasz Papszun
On Fri, 19 Nov 2004 at 7:29:58 -0600, David Green wrote: I figure that this has been covered before, but I couldn't fin it in the archives. I have clamav installed on a Apple XServe running OS X Server 10.3.6. After installation, I get this message every hour: Subject:

Re: [Clamav-users] freshclam problem

2004-11-19 Thread clamav
On Fri, 19 Nov 2004, David Green wrote: I figure that this has been covered before, but I couldn't fin it in the archives. I have clamav installed on a Apple XServe running OS X Server 10.3.6. After installation, I get this message every hour: Subject:Cron [EMAIL

[Clamav-users] unbefore seen output

2004-11-19 Thread david thompson
Hi all, I am using clamav .80 on mandrake 9.2. When scanning my mail box in the thunderbird mail folder, I get this: LibClamAV Warning: Multipart MIME message contains no boundaries and this: LibClamAV Warning: Partial message received from MUA/MTA - message cannot be scanned LibClamAV Warning:

Re: [Clamav-users] unbefore seen output

2004-11-19 Thread Nigel Horne
On Friday 19 Nov 2004 19:21, david thompson wrote: Should I be worried? Is there something wrong with my setup? No and no. Thanks for any help/reasurance. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED]

Re: [Clamav-users] ClamAV JPEG Exploit - False Positives

2004-11-19 Thread Clayton Keller
On Wed, 2004-11-17 at 20:20, Rich Graves wrote: On Wed, 17 Nov 2004, Clayton Keller wrote: It appears the issue is currently with Macintosh users trying to send .jpegs. Any known issues with the manner in which Photoshop maybe creating images. There does not appear to be any type of patch

[Clamav-users] borked database

2004-11-19 Thread Damian Menscher
Anyone care to tell us what just happened to the database? It got borked and fixed about 1/2 hour later. I'd check on the archive, but the info's pretty old Damian Menscher -- -=#| Physics Grad Student SysAdmin @ U Illinois Urbana-Champaign |#=- -=#| 488 LLP, 1110 W. Green St, Urbana, IL

Re: [Clamav-users] borked database

2004-11-19 Thread Tomasz Papszun
On Fri, 19 Nov 2004 at 19:43:19 -0600, Damian Menscher wrote: Anyone care to tell us what just happened to the database? It got borked and fixed about 1/2 hour later. I'd check on the archive, but the info's pretty old I was updating both database files. What, exactly, was wrong? --

Re: [Clamav-users] borked database

2004-11-19 Thread Damian Menscher
On Sat, 20 Nov 2004, Tomasz Papszun wrote: On Fri, 19 Nov 2004 at 19:43:19 -0600, Damian Menscher wrote: Anyone care to tell us what just happened to the database? It got borked and fixed about 1/2 hour later. I'd check on the archive, but the info's pretty old I was updating both database

Re: [Clamav-users] borked database

2004-11-19 Thread Tomasz Papszun
On Fri, 19 Nov 2004 at 20:09:06 -0600, Damian Menscher wrote: On Sat, 20 Nov 2004, Tomasz Papszun wrote: [...] What, exactly, was wrong? All my servers did this two times (15 minutes apart): Subject: Cron [EMAIL PROTECTED] /usr/local/sbin/clamdwatch.pl -q /etc/init.d/clamd condrestart

Re: [Clamav-users] borked database

2004-11-19 Thread Damian Menscher
On Sat, 20 Nov 2004, Tomasz Papszun wrote: On Fri, 19 Nov 2004 at 20:09:06 -0600, Damian Menscher wrote: Clamd didn't find the EICAR pattern. Your virus database(s) could be borked! Eicar-Test-Signature was moved to daily.cvd to let us update it later (because currently it causes FPs with some

Re: [Clamav-users] borked database

2004-11-19 Thread John Jolet
I think what happened was it was removed from main, and added to daily. Just a timing issue. On 11/19/2004 10:26 pm, Damian Menscher wrote: On Sat, 20 Nov 2004, Tomasz Papszun wrote: On Fri, 19 Nov 2004 at 20:09:06 -0600, Damian Menscher wrote: Clamd didn't find the EICAR pattern. Your

Re: [Clamav-users] borked database

2004-11-19 Thread Tomasz Kojm
On Fri, 19 Nov 2004 22:26:24 -0600 (CST) Damian Menscher [EMAIL PROTECTED] wrote: On Sat, 20 Nov 2004, Tomasz Papszun wrote: On Fri, 19 Nov 2004 at 20:09:06 -0600, Damian Menscher wrote: Clamd didn't find the EICAR pattern. Your virus database(s) could be borked! Eicar-Test-Signature