Re: [Clamav-users] Resources for integrating with spamassassin+amavisd

2010-05-03 Thread Chris Meadors
On Mon, 2010-05-03 at 05:53 -0700, Jim Preston wrote: Dennis Peterson wrote: Rsync is able to transfer only the differences between two files provided a version of the file being transferred exists on the source and the destination. In addition, rsync will not transfer anything if it

Re: [Clamav-users] Clubbing a deceased equine

2010-04-21 Thread Chris Meadors
On Wed, 2010-04-21 at 21:19 +0100, Steve Basford wrote: I did see an interesting idea on the devel mailing list from David I have a feature suggestion: Incorporate the version number in your DNS TXT records and download URLs. Your download mirrors can use symlinks in most cases (when

Re: [Clamav-users] Lots of pread fail warnings during scanning

2010-04-18 Thread Chris Meadors
On 4/18/2010 5:16 PM, Hauke Duden wrote: I did what you asked me to do and it seems that the problem is not in clamav. The files in question are marked as having a size of 4096, but when I open them I only get a few bytes of data. The strange thing is that they are all in /sys. Some in

Re: [Clamav-users] The EOL tweets

2010-04-16 Thread Chris Meadors
On Fri, 2010-04-16 at 12:14 -0400, Bowie Bailey wrote: Obviously this is not a retroactive solution, but now that they know this may be necessary, something can be changed so that it can be dealt with more smoothly in the future. It already has been. 0.95 recognizes signatures which can tell

Re: [Clamav-users] The EOL tweets

2010-04-16 Thread Chris Meadors
On Fri, 2010-04-16 at 16:00 -0400, Christopher X. Candreva wrote: Older versions of clamd were going to crash on signatures that newer versions would accept, and the devs have been prevented for at least 6 months from using that type of signature. They have posted since then for people to

Re: [Clamav-users] The EOL tweets

2010-04-16 Thread Chris Meadors
On Fri, 2010-04-16 at 22:30 +0200, Giampaolo Tomassoni wrote: So ClamAV should obey to the rules governing the open-software community. One is that everybody is free to run it own copy of the software, in whichever shape he/she likes it. You can use ClamAV how ever you like. You just can't

Re: [Clamav-users] The EOL tweets

2010-04-16 Thread Chris Meadors
On 4/16/2010 7:08 PM, Giampaolo Tomassoni wrote: This is not a matter of missing upgrades. This is a matter of proactively breaking running systems. Exactly. They proactively broke the scanner so people would know why it broke, rather than letting it die with nothing more than an obscure

Re: [Clamav-users] automated response

2008-07-28 Thread Chris Meadors
Christopher Checca wrote: I will be out of the office until 08-04-2008. Christopher Checca Packard Transport, Inc. 24021 South Municipal Dr PO Box 380 Channahon, IL. 60410 815 467 9260 815 467 6939 Fax [EMAIL PROTECTED] www.packardtransport.com Wonder if he's gone on holiday? 401

Re: [Clamav-users] Re: OT: Download script

2006-04-25 Thread Chris Meadors
On Tue, 2006-04-25 at 16:29 -0400, Christopher X. Candreva wrote: On Tue, 25 Apr 2006, G.W. Haywood wrote: If you know a gunzip option that will NOT delete the compresed file, that would be the prefered method. cat file.gz | gunzip file That's not a gunzip option -- that's

RE: [Clamav-users] Linux virus found in the /.journal file

2005-03-29 Thread Chris Meadors
On Tue, 2005-03-29 at 10:08 -0500, Cormack, Ken wrote: What filesystem type are you using, that the .journal file is visible, in the first place? I'm assuming you're using the EXT3 filesystem type? If so, those filesystems, IF properly mounted with proper /etc/fstab entries, should render

[Clamav-users] PGP Signature for Diego d'Ambra

2005-03-01 Thread Chris Meadors
I notice that Diego d'Ambra sometimes posts to the virus update list. He signs his posts with PGP, but I can't find his public key anywhere. It is not listed on the team page ( http://www.clamav.net/team.html ) like most of the other developers, and it is also not on any of the key servers I have

Re: [Clamav-users] Exploit.W32.MS05-002 False Positives

2005-02-09 Thread Chris Meadors
On Wed, 2005-02-09 at 11:51 -0500, jef moskot wrote: On Wed, 9 Feb 2005, Maxim Britov wrote: P900\Beyonce Knowles - Crazy In Love (2).wav: Exploit.W32.MS05-002 FOUND I don't know, but size is ~50-100KB. If they're tiny files, are you sure they're actually wavs? Maybe someone

Re: [Clamav-users] ClamAV should not try to detect phishing and other social engineering attacks

2004-11-15 Thread Chris Meadors
On Mon, 2004-11-15 at 12:12 -0500, Bart Silverstrim wrote: If it's a bunch of flashy graphics telling you to visit a website for fantastic deals on hiding money from third world countries while getting fantastic mortgage rates on your pen1s enlargement ointment, it's for a spam filter.

Re: [Clamav-users] MyDoom.M Starting to get through

2004-09-03 Thread Chris Meadors
On Fri, 2004-09-03 at 11:47 +0200, Scott Ryan wrote: Maybe you want to read the mail i sent again. I use clamdscan not clamscan # man clamdscan Then do you have the ScanMail option set in the clamav.conf file set? -- Chris --- This

Re: [Clamav-users] Idea for more timely virusdb updates

2004-08-09 Thread Chris Meadors
On Mon, 2004-08-09 at 16:55 -0400, Christopher X. Candreva wrote: This thread on Trojan.JS.RunMe had me thinking: Hourly virus updates is better than any of the commercial virus scanners, but obviously still has issues, especially since a bunch of us obviously submitted updates that had

Re: [Clamav-users] Compression/archive methods

2004-08-02 Thread Chris Meadors
On Mon, 2004-08-02 at 21:00 +0100, Matt wrote: Hello all, This isn't a specific Clam question, but what are the main type of archive/compression methods used on virii, when being sent as email attachments? Does it tend to be just zip/rar as a rule, or are there more variations? I believe

Re: [Clamav-users] Virus found, not detected by Clamav, can't submit (claimed already recognised but is not)

2004-07-27 Thread Chris Meadors
On Tue, 2004-07-27 at 14:06 -0400, Jim Maul wrote: Am I the only one here whos existing installation is catching MyDoom.M? [EMAIL PROTECTED] clamav]# grep -i mydoom /var/log/clamav/clamd.log Tue Jul 27 13:32:23 2004 -

Re: [Clamav-users] upgrade

2004-07-27 Thread Chris Meadors
On Tue, 2004-07-27 at 21:17 +0100, Antony Stone wrote: On Tuesday 27 July 2004 6:54 pm, Jona Tallieu wrote: Hi All, Just upgraded to 0.75 on OSX 10.3. When checking CLAMAV version to be sure the upgrade was ok I get: mail:/usr/local/bin root# ./clamscan --version clamscan /

Re: [Clamav-users] Virus found in virgin RHES 3 installation?

2004-05-07 Thread Chris Meadors
On Fri, 2004-05-07 at 13:36 -0400, Ken Morley wrote: I've just installed RedHat Enterprise ES V3 and patched to the latest revision. I then installed ClamAV 0.70, ran freshclam and did a clamdscan against the entire drive. I was surprised when clamdscan reported: //proc/kcore:

Re: [Clamav-users] Spam/Virus stats using mrtg

2004-04-02 Thread Chris Meadors
On Fri, 2004-04-02 at 14:33 -0500, John Madden wrote: #!/bin/sh VIRCOUNT=`grep -c FOUND /wherever/is/your/clamd.log` I blend in a little perl to print per-virus totals sorted by name: grep VIRUS /var/log/messages | perl -e 'while(){ $_ =~ /VIRUS:(.*)\)/; $v = $1; $hash{$v}++;} foreach

Re: [Clamav-users] RE: memory leak?

2004-03-25 Thread Chris Meadors
On Thu, 2004-03-25 at 08:56 +, Trog wrote: Well, you appear to be the only one seeing a leak. We (the devs) do check for memory leaks quite frequently, and so are pretty sure there are no big leaks. Does that include the RAR scanner? I have yet to enable it because of the comments in the

Re: [Clamav-users] Virus ID

2004-03-23 Thread Chris Meadors
On Tue, 2004-03-23 at 09:41 -0500, Bart Silverstrim wrote: Silly question time... While I suppose the questions about the standard naming sequences may help, I would propose one other idea (along with asking for help with my question :-) First: I see a hit in my logfiles for

Re: [Clamav-users] Postmaster bounces and such.

2004-03-21 Thread Chris Meadors
On Sun, 2004-03-21 at 17:40, Damian Menscher wrote: There are three cases to consider: 1 - virus from infected machine 2 - virus relayed through another server 3 - false positive Everyone agrees we don't want to generate a notification for case 1. Everyone agrees we *do* want to

[Clamav-users] Encrypted RAR Signature

2004-03-16 Thread Chris Meadors
Submission: 2005 Sender: Fisher Submitted virus name: Unknown Virus Virus name: Worm.Bagle.Gen-rarpwd Notes: Signature added through daily.cvd version 187 to Notes: detect password protected RAR files. Added: No Is this signature in effect for all scans, or only those with the

Re: [Clamav-users] Freshclam died

2004-03-16 Thread Chris Meadors
Steven P. Donegan wrote: Hmmm, I just do a freshclam from chron rather than let it run as a daemon - as a new user (I just downloaded, installed, integrated with my anti-spam/anti-virus proxy - home built, today). Is doing this in any way a negative thing? I don't think it hurts, and from the

Re: [Clamav-users] network scanning questions

2004-03-09 Thread Chris Meadors
On Tue, 2004-03-09 at 18:41, Tomasz Kojm wrote: On Tue, 9 Mar 2004 17:51:52 -0500 (EST) Charles Sprickman [EMAIL PROTECTED] wrote: Interesting; do you have any info on ICAP? Will the old network www.icap.org International Center for Alcohol Policies? Now what exactly will the new

Re: [Clamav-users] TCP on Clam Milter

2004-03-07 Thread Chris Meadors
Seve Ho wrote: I am trying to use Clamav-milter with sendmail. I found it cannot clean up it socket file(.sock) opened after killing the milter process.(I use kill -9 to kill the process, is there other prosper way to stop the milter?) And this make me have to remove the .sock file first

Re: [Clamav-users] Password-protected .zip file viruses

2004-03-03 Thread Chris Meadors
Paul Boven wrote: How about only trying every word in the mail-body as a key to try, instead of brute-forcing? The virus(-writer) cannot afford to fudge the password in the mail-body: One would hope that the subset of users that is clever enough to reconstruct the password, yet stupid enough