Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread Dennis Peterson
Tomasz Kojm wrote: On Fri, 10 Dec 2004 16:41:45 -0600 dale <[EMAIL PROTECTED]> wrote: I should have mentioned my OS (sorry about that). I am using Linux (SME server 6.0.1). I have mounted the iso and no files within the iso fail (see below for details). I have also googled and found 2 other

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread alan premselaar
Thomas Cameron wrote: > On Fri, 2004-12-10 at 08:26 +0100, Paul Bijnens wrote: > >>Thomas Cameron wrote: >> >>>Aw, heck, I finished it. It only took a few minutes and I wouldn't mind >>>a gift certificate to Amazon! >> >>Yes, I did too. >> >>Funny thing is that, with

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread Thomas Cameron
On Fri, 2004-12-10 at 08:26 +0100, Paul Bijnens wrote: > Thomas Cameron wrote: > > > > Aw, heck, I finished it. It only took a few minutes and I wouldn't mind > > a gift certificate to Amazon! > > Yes, I did too. > > Funny thing is that, within a hour I received a Worm.Sober.I virus, > which se

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread Rick Macdougall
Thomas Cameron wrote: On Fri, 2004-12-10 at 08:26 +0100, Paul Bijnens wrote: Does that mean I missed the $25 gif certificate, and this is the second prize? :-) LOL! On a (slightly) more serious note, I didn't get the gift certificate. Did anyone else? Not yet but it may take a week or more for t

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread Tomasz Kojm
On Fri, 10 Dec 2004 17:21:48 -0600 dale <[EMAIL PROTECTED]> wrote: > Tomasz Kojm wrote: > > Please save this line to a test.ndb file: > > > > Trojan.URLspoof.gen:3:*:6c6f636174696f6e2e687265663d756e65736361706 > > 5282*3a2f2f*25303140*2729 > > > > run `clamscan -d test.ndb` on problematic files

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread dale
Tomasz Kojm wrote: On Fri, 10 Dec 2004 17:21:48 -0600 dale <[EMAIL PROTECTED]> wrote: Tomasz Kojm wrote: Please save this line to a test.ndb file: Trojan.URLspoof.gen:3:*:6c6f636174696f6e2e687265663d756e65736361706 5282*3a2f2f*25303140*2729 run `clamscan -d test.ndb` on problematic files and post

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread Tomasz Kojm
On Fri, 10 Dec 2004 14:57:21 -0600 dale <[EMAIL PROTECTED]> wrote: > Hello, > Can anyone direct me to a script sh/perl/etc that can find the > smallest > area within a file that has a virus signature? I have a 700MB iso > file with a false positive, and I would like to submit only th

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread dale
Tomasz Kojm wrote: Please save this line to a test.ndb file: Trojan.URLspoof.gen:3:*:6c6f636174696f6e2e687265663d756e657363617065282 *3a2f2f*25303140*2729 run `clamscan -d test.ndb` on problematic files and post the result here. [EMAIL PROTECTED] root]# clamscan -d test.ndb /home/e-smith/files/iba

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread Tomasz Kojm
On Fri, 10 Dec 2004 16:41:45 -0600 dale <[EMAIL PROTECTED]> wrote: > I should have mentioned my OS (sorry about that). I am using > Linux > (SME server 6.0.1). I have mounted the iso and no files within the iso > > fail (see below for details). I have also googled and found 2 other

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread dale
Nigel Horne wrote: On Fri, 2004-12-10 at 20:57, dale wrote: Hello, Can anyone direct me to a script sh/perl/etc that can find the smallest area within a file that has a virus signature? I have a 700MB iso file with a false positive, and I would like to submit only the signature part of the fil

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread Nigel Horne
On Fri, 2004-12-10 at 21:58, Erick Lopez Carreon wrote: > On Fri, 2004-12-10 at 16:53 -0500, John Madden wrote: > > > Where is the reference to CrossOver Office??? > > > > They must show a different selection of three projects for each > > submission? At any rate, despite running nearly 100% OSS

[Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread dale
Hello, Can anyone direct me to a script sh/perl/etc that can find the smallest area within a file that has a virus signature? I have a 700MB iso file with a false positive, and I would like to submit only the signature part of the file to someone for analysis. Thanks, Dale ___

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread Erick Lopez Carreon
On Fri, 2004-12-10 at 16:53 -0500, John Madden wrote: > > Where is the reference to CrossOver Office??? > > They must show a different selection of three projects for each > submission? At any rate, despite running nearly 100% OSS in everything I > do, I didn't use any of the three they provided

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread John Madden
> Where is the reference to CrossOver Office??? They must show a different selection of three projects for each submission? At any rate, despite running nearly 100% OSS in everything I do, I didn't use any of the three they provided me to choose from. John -- John Madden UNIX Systems Engine

Re: [Clamav-users] baffled - 0.75.1 ran flawlessly, 0.80 crashes regularly

2004-12-10 Thread clamav
At 11:44 AM 12/9/2004, [EMAIL PROTECTED] wrote: Subject pretty much says it. for reference, both .75 and .80 were built with the following: #!/bin/sh ./configure \ --with-gnu-ld \ --with-user=qscand \ --with-group=qscand \ --enable-bigstack \ --disable-clamuko thanks for the responses, everyone. i

Re: [Clamav-users] baffled - 0.75.1 ran flawlessly, 0.80 crashes regularly

2004-12-10 Thread clamav
At 01:16 PM 12/10/2004, you wrote: 24038 clamdRET poll 0 24038 clamdCALL gettimeofday(0x2811db18,0) 24038 clamdRET gettimeofday 0 24038 clamdCALL clock_gettime(0,0xbfaedfa8) 24038 clamdRET clock_gettime 0 24038 clamdCALL poll(0x8064000,0xb,0) 24038 clamdR

[Clamav-users] VMWARE and False positives?

2004-12-10 Thread Scott Moore
I am getting the following in my scans and knowing what I know about Vmware, I think they are false positives: C:\VMware Files\RH72 BASE\Linux.vmdk: Exploit.IFrame.Gen FOUND C:\VMware Files\RH72 Test ED\Linux.vmdk: Exploit.IFrame.Gen FOUND C:\VMware Files\W2K SQL IIS ActiveX Dev\Windows 2000 Serv

Re: [Clamav-users] script to find smallest area of file that contains signature

2004-12-10 Thread Nigel Horne
On Fri, 2004-12-10 at 20:57, dale wrote: > Hello, > Can anyone direct me to a script sh/perl/etc that can find the smallest > area within a file that has a virus signature? I have a 700MB iso file > with a false positive, and I would like to submit only the signature > part of the file to

[Clamav-users] ERROR: Verification: Broken or not a CVD file while testing freshclam

2004-12-10 Thread ads nat
I am running Redhat 9.0 with sendmail 8.13 and clamav 0.80 wokring fine. I am changed settings in "freshclam.conf" file as directed in docs. When I tryu to test "freashclam" without any parameters as directed in docs it gives me following ERROR : ## [EMAIL PROTECTED] root]# freshclam Clam

Re: [Clamav-users] Research on ClamAV

2004-12-10 Thread Paul Bijnens
Thomas Cameron wrote: Aw, heck, I finished it. It only took a few minutes and I wouldn't mind a gift certificate to Amazon! Yes, I did too. Funny thing is that, within a hour I received a Worm.Sober.I virus, which seems to be a backscattered mail from amazon.com (original source 213.22.187.170, wi