Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread Török Edwin
On 2008-10-16 23:19, Hans Morten Kind wrote: > On Thu, Oct 16, 2008 at 10:29:02PM +0300, Török Edwin wrote: > >> Please open a bug on bugs.clamav.net, and attach your gdb backtrace. >> Also please attach one sample that reproduce the bug to the bugzilla. >> > > Thanks for your prompt and fr

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Fri, 17 Oct 2008 07:41:52 +0100 (BST) "Steve Basford" <[EMAIL PROTECTED]> wrote: > > There's a special option in freshclam (--submit-stats, currently > > deactivated) > > Hi Tomasz, from how I'd use it here, it'd certainly be a good idea to > enable this option. > > As a side note, for users

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Steve Basford
> There's a special option in freshclam (--submit-stats, currently > deactivated) Hi Tomasz, from how I'd use it here, it'd certainly be a good idea to enable this option. As a side note, for users of the windows port... they'd normally run freshclam damonised... and then could run the "special"

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Török Edwin
On 2008-10-17 05:11, René Berber wrote: > Nigel Horne wrote: > > >> 0.94.1 RC1 was published on schedule yesterday. >> > [snip] > > Has anyone seen a problem testing with the contents of test/.split? > > In particular 'clamscan test/.split/split.clam.exe.htmlaa' just holds > the CPU at 100%

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Thu, 16 Oct 2008 17:41:50 -0700 John Rudd <[EMAIL PROTECTED]> wrote: > Do you have any thoughts about how we can get the stats to you, so that > you can use them, without bypassing our mechanism for ensuring > consistent and safe updating of our virus signatures? There's a special option in

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Bill Maidment
On Thu, 16 Oct 2008 17:41:50 -0700, John Rudd wrote > Tomasz Kojm wrote: > > > > Freshclam also submits information about detections with 3rd party > > signatures. > > > > We only have one host in our environment that does freshclam (or any of > the other virus signature update mechanisms). Sa

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread René Berber
Nigel Horne wrote: > 0.94.1 RC1 was published on schedule yesterday. [snip] Has anyone seen a problem testing with the contents of test/.split? In particular 'clamscan test/.split/split.clam.exe.htmlaa' just holds the CPU at 100% for a long time... I've killed it on two runs. -- René Berber __

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread John Rudd
Tomasz Kojm wrote: > > Freshclam also submits information about detections with 3rd party signatures. > We only have one host in our environment that does freshclam (or any of the other virus signature update mechanisms). It verifies the validity of the data (makes sure nothing will die as a

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Dennis Peterson
Stephen Gran wrote: > On Thu, Oct 16, 2008 at 03:51:32PM -0700, Dennis Peterson said: >> Running diff on the new config files and old config files did not reveal >> any new options. > > Freshclam has one new option, disabled by default - fairly harmless for > upgrades, but useful for redistributo

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Stephen Gran
On Thu, Oct 16, 2008 at 03:51:32PM -0700, Dennis Peterson said: > Running diff on the new config files and old config files did not reveal > any new options. Freshclam has one new option, disabled by default - fairly harmless for upgrades, but useful for redistributors to note if they handle that

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Dennis Peterson
Nigel Horne wrote: > Folks, > > 0.94.1 RC1 was published on schedule yesterday. Built fine but installed with errors on Solaris 9. Solaris has obsoleted ranlib but has a stub file, /usr/ccs/bin/ranlib. Configure found it and of course it failed. I renamed it and clamav built and installed fine.

Re: [Clamav-users] False positive? PUA.Script.Packed-1

2008-10-16 Thread Kelson
Tony Finch wrote: > I've advised the user to email links instead of whole pages, but I'm > wondering why jQuery is classed as a PUA - is this deliberate or is > it a false positive? I think "PUA" indicates "Potentially Unwanted (something)" -- basically code or tools that have legitimate uses, bu

Re: [Clamav-users] announcing ClamAV 0.94.1rc1

2008-10-16 Thread sydz
Luca Gibelli writes: > Dear ClamAV users, > ClamAV 0.94.1rc1 has been released. gcc 4.0.1 caused configuration failure with PR bug 28045 Bypassed with CFLAGS='O0' and installed successfully on Macintosh PowerPC G4 (10.4.11). make check returned the following: make check-TESTS *** Unit t

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread kwijibo
Hans Morten Kind wrote: > setenv CC "/opt/SUNWspro/bin/cc -m64" > setenv LDFLAGS "-L/opt/lib/64 -R/opt/lib/64 -lz -lgmp -L/lib/64 -R/lib/64 > -L/usr/lib/64 -R/usr/lib/64" > setenv CFLAGS "-xO2 -g" Hrmm. I just let the configure script find the libs and I used gcc to compile. So pretty much

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Thu, 16 Oct 2008 22:00:15 +0200 Matthias Häker <[EMAIL PROTECTED]> wrote: > up and running in 5m on FreeBSD 4.8 :-) [...] > SubmitDetectionStats: Submitted 50 records Thanks! :-) -- oo. Tomasz Kojm <[EMAIL PROTECTED]> (\/)\. http://www.ClamAV.net/gpg/tko

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Matthias Häker
up and running in 5m on FreeBSD 4.8 :-) +++ Started at Thu Oct 16 21:48:29 2008 Thu Oct 16 21:48:29 2008 -> clamd daemon 0.94.1rc1 (OS: freebsd4.8, ARCH: i386, CPU: i386) Thu Oct 16 21:48:29 2008 -> Running as user clamav (UID 1028, GID 1001) freshclam.conf + # When enabled freshclam will

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread Hans Morten Kind
On Thu, Oct 16, 2008 at 10:29:02PM +0300, Török Edwin wrote: > Please open a bug on bugs.clamav.net, and attach your gdb backtrace. > Also please attach one sample that reproduce the bug to the bugzilla. Thanks for your prompt and friendly reply. I will open an issue when I have cleaned out our de

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread Török Edwin
On 2008-10-16 19:57, Hans Morten Kind wrote: > When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1, > our solaris servers started dumping cores. We are experiencing the same > behavour with simple .doc-files also on 0.94 and the latest devel-release. > > hdr.m_area is memcpy'd

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread kwijibo
Hans Morten Kind wrote: > On Thu, Oct 16, 2008 at 11:21:25AM -0600, [EMAIL PROTECTED] wrote: >> Hans Morten Kind wrote: >>> When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1, >>> our solaris servers started dumping cores. We are experiencing the same >>> behavour with simple

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Thu, 16 Oct 2008 10:18:16 -0700 Dennis Peterson <[EMAIL PROTECTED]> wrote: > That is just one host. Does the connection die gracefully if that host > is unavailable? Yes, it does (it will timeout after ConnectTimeout/ReceiveTimeout as configured in freshclam.conf). -- oo.

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread Hans Morten Kind
On Thu, Oct 16, 2008 at 11:21:25AM -0600, [EMAIL PROTECTED] wrote: > Hans Morten Kind wrote: > > When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1, > > our solaris servers started dumping cores. We are experiencing the same > > behavour with simple .doc-files also on 0.94 and

Re: [Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread kwijibo
Hans Morten Kind wrote: > When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1, > our solaris servers started dumping cores. We are experiencing the same > behavour with simple .doc-files also on 0.94 and the latest devel-release. > > hdr.m_area is memcpy'd to &hdr with hdr_siz

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Dennis Peterson
Tomasz Kojm wrote: > On Thu, 16 Oct 2008 13:43:12 +0100 > "Randal, Phil" <[EMAIL PROTECTED]> wrote: > >> I haven't had the time to check the source code. >> >> How does it send it? What protocol and port, to which servers? >> >> Anything that firewall admins will need to be aware of? > > It send

[Clamav-users] solaris10 crashes in cli_ole2_extract with 0.94

2008-10-16 Thread Hans Morten Kind
When vba-detection in libclamav/ole2_extract.c was implemented in 0.93.1, our solaris servers started dumping cores. We are experiencing the same behavour with simple .doc-files also on 0.94 and the latest devel-release. hdr.m_area is memcpy'd to &hdr with hdr_size in the entry of cli_ole2_extract

Re: [Clamav-users] Errors building ClamAV 0.94.1 RC1

2008-10-16 Thread Nigel Horne
> In configure, I see bzlib warnings that aren't present in 0.94. > (./configure --prefix=/usr --sysconfdir=/etc --enable-milter) Jason, Please file a bug report at bugs.clamav.net. Thanks, -Nigel ___ Help us build a comprehensive ClamAV gui

[Clamav-users] Errors building ClamAV 0.94.1 RC1

2008-10-16 Thread Jason Bertoch
In configure, I see bzlib warnings that aren't present in 0.94. (./configure --prefix=/usr --sysconfdir=/etc --enable-milter) 0.94: checking bzlib.h usability... yes checking bzlib.h presence... yes checking for bzlib.h... yes checking for CVE-2008-1372... ok 0.94.1 RC1: checking bzlib.h usabilit

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Randal, Phil
Tomasz Kojm wrote: > On Thu, 16 Oct 2008 13:43:12 +0100 > "Randal, Phil" <[EMAIL PROTECTED]> wrote: > >> I haven't had the time to check the source code. >> >> How does it send it? What protocol and port, to which servers? >> >> Anything that firewall admins will need to be aware of? > > It se

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Thu, 16 Oct 2008 13:43:12 +0100 "Randal, Phil" <[EMAIL PROTECTED]> wrote: > I haven't had the time to check the source code. > > How does it send it? What protocol and port, to which servers? > > Anything that firewall admins will need to be aware of? It sends information about a file name,

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Randal, Phil
Steve Basford wrote: >> For details of the new features please refer to the Changelog. For an >> overview please refer to >> http://www.clamav.net/press/0.94.1-WhatsNew.pdf. >> > > Nigel, does the stats sent... only send information regarding ClamAV > default signatures (when detected)... or doe

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Tomasz Kojm
On Thu, 16 Oct 2008 13:20:27 +0100 (BST) "Steve Basford" <[EMAIL PROTECTED]> wrote: > > > > For details of the new features please refer to the Changelog. For an > > overview please refer to http://www.clamav.net/press/0.94.1-WhatsNew.pdf. > > > > Nigel, does the stats sent... only send informati

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Steve Basford
> > For details of the new features please refer to the Changelog. For an > overview please refer to http://www.clamav.net/press/0.94.1-WhatsNew.pdf. > Nigel, does the stats sent... only send information regarding ClamAV default signatures (when detected)... or does this also include detections by

Re: [Clamav-users] Virus in main.ndb?

2008-10-16 Thread Uwe Kiewel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Markus Egg schrieb: > I am using clamav 0.94. > > I copied > /usr/local/share/clamav > to > /usr/local/share/clamav15102008 > because there were problems in getting the newest database today. > > Then I checked > /usr/local/share/clamav15102008 > wi

Re: [Clamav-users] Outdated Engine warning suppress

2008-10-16 Thread veselin
Thanks for the input. Veselin On Wed, Oct 15, 2008 at 09:58:19AM -0400, Charles Gregory wrote: > Veselin@ wrote: > > I'm running Debian in a production environment, > > I cannot afford using the "volatile" repository, > On Wed, 15 Oct 2008, Bowie Bailey wrote: > > Either install it from "volatil

Re: [Clamav-users] Announcing ClamAV 0.94.1 RC1

2008-10-16 Thread Nigel Horne
Folks, 0.94.1 RC1 was published on schedule yesterday. For details of the new features please refer to the Changelog. For an overview please refer to http://www.clamav.net/press/0.94.1-WhatsNew.pdf. We encourage as many people as possible to test this release candidate by downloading it from w