Re: [clamav-users] VIRUS ({HEX}EICAR.TEST.10.UNOFFICIAL) in mail FROM [198.148.79.53]

2017-10-03 Thread Anssi Johansson
Ralph Seichter kirjoitti 3.10.2017 klo 17.33: A virus was found: {HEX}EICAR.TEST.10.UNOFFICIAL First upstream SMTP client IP address: [198.148.79.53]:24855 lists.clamav.net Received from: 198.148.79.53 < 127.0.0.1 < 204.29.186.62 < 172.26.252.15 < 10.76.1.211 < 149.32.192.35 Return-Path: Fr

Re: [clamav-users] EICAR file problems

2017-10-03 Thread Anssi Johansson
Nymblewyke kirjoitti 3.10.2017 klo 17.13: Here are some details. Seems like it should work, just trying to find the log to see if there is an issue. I tried what you tried: [/]# echo 'X50!P%...' > eicar.text This is wrong, it should be X5O (big O) and not X50 (zero). Cut and paste is your

Re: [clamav-users] EICAR file problems

2017-10-03 Thread Anssi Johansson
Nymblewyke kirjoitti 3.10.2017 klo 13.20: Trying to trigger CLAMAV with an EICAR file for a test. The file reacts on a windows machine, but on a redhat machine using clamav there is no trigger at all. We are using the standard eicar text file. Any thoughts on where to look for details on why i

Re: [clamav-users] 5 minutes to start

2016-11-18 Thread Anssi Johansson
18.11.2016, 23.10, Richard Doyle kirjoitti: Yes, clamd on my system is taking about 5 minutes to start, which causes timeouts. This issue developed just this week. I found that setting OfficialDatabaseOnly true helped considerebly--clamd loads in a few seconds. I'd really like to get back to u

[clamav-users] ftp.heanet.ie mirror problem

2015-08-04 Thread Anssi Johansson
It was recently brought to my attention that db.se.clamav.net points to a single IP address, 193.1.193.64, which is ftp.heanet.ie. Sadly that mirror does not seem to accept requests from anywhere, but instead replies with a 403. This can be tested with: curl -H "Host: db.local.clamav.net" -I

Re: [clamav-users] daily.cvd out of date?

2015-02-26 Thread Anssi Johansson
If you do know the IP addresses of the outdated mirrors, I think that information might be very very useful in diagnosing this problem. For what it's worth, works fine here. 26.2.2015, 18.14, Smith, David kirjoitti: Interestingly I just ran it on one more server and got the correct date... Co

[clamav-users] PHP.Exploit.CVE_2011_4153-3 false positive

2012-11-20 Thread Anssi Johansson
Hi, $ clamscan php*.bz2 php-5.4.0.tar.bz2: PHP.Exploit.CVE_2011_4153-3 FOUND php-5.4.1.tar.bz2: PHP.Exploit.CVE_2011_4153-3 FOUND php-5.4.3.tar.bz2: PHP.Exploit.CVE_2011_4153-3 FOUND $ md5sum php*.bz2 04bb6f9d71ea86ba05685439d50db074 php-5.4.0.tar.bz2 5b9529ed89dbc48c498e9693d1af3caf php-5.4.1