[Clamav-users] Problem Running Freshclam

2008-03-31 Thread Kaplan, Andrew H.
Hi there - I was checking the logs of one of our servers, and I discovered the automated freshclam process failed to update the virus definitions. I checked on the mirror-problem page, and went through the motions of renaming the mirrors.dat file, and manually running the freshclam utility

Re: [Clamav-users] Problem Running Freshclam

2008-03-31 Thread Török Edwin
Kaplan, Andrew H. wrote: Hi there - I was checking the logs of one of our servers, and I discovered the automated freshclam process failed to update the virus definitions. I checked on the mirror-problem page, and went through the motions of renaming the mirrors.dat file, and

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread rick pim
Dennis Peterson writes: But we know from the volumes of spam and viruses now approaching if not exeeding 90% that you are the exception, not the norm. spam yes, viruses. not so much. our experience has been that email-borne viruses are way, way down: yesterday's logs from one of our

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Dennis Peterson
rick pim wrote: Dennis Peterson writes: But we know from the volumes of spam and viruses now approaching if not exeeding 90% that you are the exception, not the norm. spam yes, viruses. not so much. our experience has been that email-borne viruses are way, way down: yesterday's

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread John Rudd
rick pim wrote: Dennis Peterson writes: But we know from the volumes of spam and viruses now approaching if not exeeding 90% that you are the exception, not the norm. spam yes, viruses. not so much. our experience has been that email-borne viruses are way, way down: yesterday's

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread John Rudd
Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net cannot be subverted into being a spam/virus zombie is, at best, naive. And

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Dennis Peterson
John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net cannot be subverted into being a spam/virus zombie is,

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Bit Fuzzy
Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, Two minutes to hack a Mac and it's now available to generate spam and become a drone to spread malware for other Macs or Windows systems. It

Re: [Clamav-users] Problem Running Freshclam

2008-03-31 Thread kwijibo
Kaplan, Andrew H. wrote: Hi there -- It appears the DNS server the server uses does not allow recursion. Is it possible to configure the freshclam.conf file to connect via the ip address of the database server, and if so what is the address to use? Thanks. You would be better off using

Re: [Clamav-users] Problem Running Freshclam

2008-03-31 Thread Kaplan, Andrew H.
Hi there -- I spoke with our Information Security people, and I was able to configure the system in question to resolve to a different set of DNS servers. Once that was done, I reran freshclam, and this time the update completed successfully. -Original Message- From: [EMAIL PROTECTED]

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Steve Holdoway
On Mon, 31 Mar 2008 08:07:32 -0700 Dennis Peterson [EMAIL PROTECTED] wrote: John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows,

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net cannot be subverted into being a spam/virus zombie is,

[Clamav-users] virus database maintainer team overloaded?

2008-03-31 Thread Luis Miguel R.
Hi, I send a new trojan to the database maintainers a week ago and still is not recognized by clamav, are database maintainers overloaded? http://www.virustotal.com/es/analisis/7031b9020ce7bc0ed57215ed5ebf2f82 Regards. ___ Help us build a

Re: [Clamav-users] virus database maintainer team overloaded?

2008-03-31 Thread Jason Bertoch
-Original Message- From: [EMAIL PROTECTED] [mailto:clamav-users- [EMAIL PROTECTED] On Behalf Of Luis Miguel R. Sent: Monday, March 31, 2008 2:50 PM To: clamav-users@lists.clamav.net Subject: [Clamav-users] virus database maintainer team overloaded? Hi, I send a new trojan to the

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread John Rudd
Joe Sloan wrote: John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net cannot be subverted into being a

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
John Rudd wrote: Joe Sloan wrote: John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net cannot be subverted

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread John Rudd
Joe Sloan wrote: John Rudd wrote: Joe Sloan wrote: John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform (windows, unix/linux, etc.) attached to the net

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Henrik K
On Mon, Mar 31, 2008 at 12:38:23PM -0700, Joe Sloan wrote: John Rudd wrote: Joe Sloan wrote: John Rudd wrote: Dennis Peterson wrote: And to follow up on the earlier point about Windows systems not being the sole source of spam/virus distribution, The idea that any platform

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
John Rudd wrote: Just because they're in a non-windows environment doesn't mean they can't possibly be sending out viruses. The person who expressed that is, as I said, being naive. And, irresponsible. While it's fine to talk theory, the facts of the matter are fairly clear. We run mail

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Dennis Peterson
Joe Sloan wrote: John Rudd wrote: Just because they're in a non-windows environment doesn't mean they can't possibly be sending out viruses. The person who expressed that is, as I said, being naive. And, irresponsible. While it's fine to talk theory, the facts of the matter are

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread James Kosin
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ben wrote: | I run clamd on a CentOS server, with freshclam, and clamsmtpd to scan mail. | And I use it interfacing with postfix. | However, just clamd alone uses 23 Megabytes when idle! | | Can someone post configuration options to limit or lower

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Gerard
On Mon, 31 Mar 2008 12:59:05 -0700 Joe Sloan [EMAIL PROTECTED] wrote: John Rudd wrote: Just because they're in a non-windows environment doesn't mean they can't possibly be sending out viruses. The person who expressed that is, as I said, being naive. And, irresponsible. While it's

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread kwijibo
Dennis Peterson wrote: How are able to determine that? There's nothing in the connection information or in the message that identifies the source OS, hardware, or MTA. Everything in a message can be spoofed as can the sending system. The only thing you can be sure of is the IP you log

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Eric Rostetter
Quoting Joe Sloan [EMAIL PROTECTED]: While it's fine to talk theory, the facts of the matter are fairly clear. Are they? We run mail servers that see tens of millions of messages monthly on behalf of 15,000 users. I run much smaller ones... Out of the thousands of different viruses

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Jason Haar
[EMAIL PROTECTED] wrote: P0f maybe? Although with my experience it has never been that accurate and is easy to fool if one so desires. We're using p0f integrated into Qmail-Scanner to track what OS is associated with incoming SMTP connections. Just to add some 'facts' to this discussion,

[Clamav-users] General Discussion on malware, spam, and (thanks for all the) phish ; WAS Re: Memory usage for clamd is huge

2008-03-31 Thread Randal Hicks
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, Just changing the subject to reflect the interesting discussion that we have veered onto... Jason, thanks for the statistics; I'm curious what other people are seeing. The nomenclature used (viruses, quarantine etc.) reflects (IMHO) the

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
Gerard wrote: On Mon, 31 Mar 2008 12:59:05 -0700 Joe Sloan [EMAIL PROTECTED] wrote: John Rudd wrote: Just because they're in a non-windows environment doesn't mean they can't possibly be sending out viruses. The person who expressed that is, as I said, being naive. And, irresponsible.

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
Dennis Peterson wrote: Joe Sloan wrote: Perhaps our sample size is too small, but it certainly seems that this whole overhyped idea of viruses apart from ms windows is a non-issue in practice. How are able to determine that? There's nothing in the connection information or in the

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
Jason Haar wrote: [EMAIL PROTECTED] wrote: P0f maybe? Although with my experience it has never been that accurate and is easy to fool if one so desires. We're using p0f integrated into Qmail-Scanner to track what OS is associated with incoming SMTP connections. Just to add some

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Steve Holdoway
On Mon, 31 Mar 2008 19:38:10 -0700 Joe Sloan [EMAIL PROTECTED] wrote: Dennis Peterson wrote: Joe Sloan wrote: Perhaps our sample size is too small, but it certainly seems that this whole overhyped idea of viruses apart from ms windows is a non-issue in practice. How are able to

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Dennis Peterson
Joe Sloan wrote: Dennis Peterson wrote: Joe Sloan wrote: Perhaps our sample size is too small, but it certainly seems that this whole overhyped idea of viruses apart from ms windows is a non-issue in practice. How are able to determine that? There's nothing in the connection

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Joe Sloan
Dennis Peterson wrote: I've had a feeling for several posts that we have not been having the same conversation. I've never seen anything but Windows viruses in the nearly 30 years I've been doing this but that's not what we're talking about. We're talking about the probability that Windows

Re: [Clamav-users] Memory usage for clamd is huge

2008-03-31 Thread Bit Fuzzy
It may be just me, but I think this topic has been beaten to death :-\ ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Non-Windoze Viruses (was Re: Memory usage for clamd is huge)

2008-03-31 Thread Steve Holdoway
On Mon, 31 Mar 2008 23:01:10 -0400 David F. Skoll [EMAIL PROTECTED] wrote: I do not believe there has been a real Linux virus in the wild, and I can't believe someone wouldn't have created one by now if it were as easy as on Windoze. Heck, even MSFT has probably tried as part of it's FUD