Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Tomasz Papszun
On Wed, 23 Mar 2005 at 19:49:30 +0100, Guillaume Arcas wrote: Tomasz Papszun a écrit : Unpack the CVD containers so some other directory, remove the unwanted signature from the plain text databases, instruct the clamscan (or clamd) to use databases from that other directory. Means that

Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Guillaume Arcas
Tomasz Papszun a écrit : in case you wanted to disable some signature because of a false positive, the proper way of solving this is submitting the sample at http://www.clamav.net/sendvirus.html (selecting the button A false positive) so that the signature could be corrected/removed. This

Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Thomas Lamy
Guillaume Arcas schrieb: Tomasz Papszun a écrit : in case you wanted to disable some signature because of a false positive, the proper way of solving this is submitting the sample at http://www.clamav.net/sendvirus.html (selecting the button A false positive) so that the signature could be

Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Bogusław Brandys
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Guillaume Arcas wrote: Tomasz Papszun a crit : in case you wanted to disable some signature because of a false positive, the proper way of solving this is submitting the sample at http://www.clamav.net/sendvirus.html (selecting the button A

Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Guillaume Arcas
Thomas Lamy a écrit : No it's not faster. But it's more secure, because it's signed, and it's contents is compressed. OK, that does explain why clamscan runs a little faster with text signatures database than with CVD files. Shoud not be a problem with clamd for databases are loaded once but

Re: [Clamav-users] Building his own CVD

2005-03-24 Thread Thomas Lamy
Guillaume Arcas schrieb: Thomas Lamy a écrit : No it's not faster. But it's more secure, because it's signed, and it's contents is compressed. OK, that does explain why clamscan runs a little faster with text signatures database than with CVD files. Shoud not be a problem with clamd for

[Clamav-users] freshclam fails upon FreeBSD server restart

2005-03-24 Thread Scott Plumee
Revisiting an earlier problem I thought I had solved. FreeBSD server 4.7, running clamav 0.83. Used the FreeBSD port to install, added the proper lines to /etc/rc.d to enable it. Upon a server reboot, freshclam fails to update the database. ClamAV update process started at Thu Mar 24 16:20:48

Re: [Clamav-users] freshclam fails upon FreeBSD server restart

2005-03-24 Thread Steffen Winther Soerensen
On Thu, 2005-03-24 at 11:33 -0500, Scott Plumee wrote: Revisiting an earlier problem I thought I had solved. ClamAV update process started at Thu Mar 24 16:20:48 2005 ERROR: Can't get information about database.clamav.net host. Giving up on database.clamav.net... ERROR: Update failed. Your

Re: [Clamav-users] freshclam fails upon FreeBSD server restart

2005-03-24 Thread Steffen Winther Soerensen
On Thu, 2005-03-24 at 12:18 -0500, Scott Plumee wrote: Sounds very much like your network connection and resolve lib isn't in place at this time, try to delay running freshclam until network connection is in place. Not sure if this is the best way to do it, but I added a 30 second

Re: [Clamav-users] freshclam fails upon FreeBSD server restart

2005-03-24 Thread Matt Fretwell
Scott Plumee wrote: Not sure if this is the best way to do it, but I added a 30 second delay to the /usr/local/etc/rc.d/clamav-freshclam.sh script. However, still did not solve it - same error on a reboot. It's a virtual server, and the entire reboot process only takes about 15 seconds

Re: [Clamav-users] freshclam fails upon FreeBSD server restart

2005-03-24 Thread Tomasz Papszun
On Thu, 24 Mar 2005 at 12:18:24 -0500, Scott Plumee wrote: Steffen Winther Soerensen wrote: Sounds very much like your network connection and resolve lib isn't in place at this time, try to delay running freshclam until network connection is in place. Not sure if this is the best way to

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-03-24 Thread Elizabeth Schwartz
On Mon, 7 Mar 2005 19:52:55 -0500, David Blank-Edelman [EMAIL PROTECTED] wrote: I just wanted to pop in and provide the latest update on our saga (clamd 0.83 just stops playing nice after running for a while) with some more interesting information like stack traces. This sounds like exactly

[Clamav-users] test virus # 14 - my setup or something else?

2005-03-24 Thread Sean Franklin
Hello, I periodically check the mail server using the website: http://www.testvirus.org/ I can't remember from last time to this time if everything except 24/25 got blocked or if 14 was a problem last time too. (24 and 25 are non-virus, but suspect code/attachment.) Anyway, #14 got thru this

Re: [Clamav-users] test virus # 14 - my setup or something else?

2005-03-24 Thread Nigel Horne
On Thursday 24 Mar 2005 18:16, Sean Franklin wrote: Hello, I periodically check the mail server using the website: http://www.testvirus.org/ I can't remember from last time to this time if everything except 24/25 got blocked or if 14 was a problem last time too. (24 and 25 are non-virus, but

RE: [Clamav-users] test virus # 14 - my setup or something else?

2005-03-24 Thread Shayne Lebrun
It caught the other 24. Is there something special about the TNEF file that needs to be configured in clamd.conf or clamsmtpd.conf to scan that or is it something else. Microsoft TNEF is neither a transport, nor neutral, nor encoding, nor a format. Discuss. You need to decode TNEFs with

Re: [Clamav-users] test virus # 14 - my setup or something else?

2005-03-24 Thread jef moskot
On Thu, 24 Mar 2005, Sean Franklin wrote: http://www.testvirus.org/ Anyway, #14 got thru this time: Test #14: Eicar virus sent in a Microsoft TNEF file (winmail.dat) I noticed the same thing this week. I believe, as Nigel mentioned, that the winmail.dat file is corrupt and cannot be read. I

Re: [Clamav-users] test virus # 14 - my setup or something else?

2005-03-24 Thread Nigel Horne
On Thursday 24 Mar 2005 18:36, Shayne Lebrun wrote: You need to decode TNEFs with something else before passing them to Clam. This restriction will be lifted soon (with any luck and a few samples for testing). -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK.

Re: [Clamav-users] clamd on Solaris ceases functioning after a while

2005-03-24 Thread David Blank-Edelman
On Mar 24, 2005, at 1:12 PM, Elizabeth Schwartz wrote: This sounds like exactly what I was experiencing. Did the latest build fix it for you? Turning off clamd and running clamav-milter without the --external flag seems to have fixed it for me. Hi Betsy- See my followup message on March 17th,

[Clamav-users] submission of phishing emails

2005-03-24 Thread Jeremy Kitchen
For some reason I'm a huge target for phishing emails (clamav blocks about 30 of them a day on my system of about .. 10 users). I get a few every day that slip by clamav and end up in my spam folder (SARE rulesets catch most of them) so I figure I could submit them to the clamav team for

Re: [Clamav-users] submission of phishing emails

2005-03-24 Thread David Blank-Edelman
Hi Jeremy- If you run the message back through SA with the -d or --remove-markup switch, it will undo its encapsulation of the spam message. -- dNb ___ http://lurker.clamav.net/list/clamav-users.html

RE: [Clamav-users] Re: Problem compiling

2005-03-24 Thread René Berber
J. Rivero Hi Rene, Hello. I am having exactly the same problem as Ed Vazquez. And I have pthread.h in my /usr/include directory. I would like to use the POSIX threads to have decent performance, any idea other than disable pthreads? Thanks, J Rivero Here a cut-and Paste (OpenBSD

Re: [Clamav-users] CPU dogging in 0.83 and current CVS

2005-03-24 Thread email builder
Bump Hi, I recently upgraded from 0.80 to 0.83. I have seen a dramatic increase in CPU usage. Running inside of amavisd-new, my five amavis servers hog the CPU with around 20% each and up to 50% or more for one server process when the others are idling. Word had it that there