Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-03 Thread Tomasz Papszun
On Thu, 01 Dec 2005 at 17:26:24 -0800, [EMAIL PROTECTED] wrote: Matthew.van.Eerde wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc Hmm... why is there a --config-file switch for clamdscan? E.g. one can run more than one clamd

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: Kill all your freshclam and clamd processes. Put your .pid and socket files in a place that clamd can write. clamd starts as root, but if it needs to SIGHUP, it needs to recreate the .pid files and reinitialize the socket as clamd. I've done all this now but

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs read access to it. srwxrwxrwx1

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread Matthew.van.Eerde
Matthew.van.Eerde wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc Hmm... why is there a --config-file switch for clamdscan? I see it's in the man page... does it really work for all options? -- Matthew.van.Eerde (at) hbinc.com

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread The Disc Shop
[EMAIL PROTECTED] wrote: The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/abc: Access denied. ERROR What are the permissions on /var/spool/virtual/thediscshop.com.au/abc ? clamd user needs

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-12-01 Thread John W. Baxter
On 12/1/05 5:40 PM, The Disc Shop [EMAIL PROTECTED] wrote: Ah okay, my bad. Misread the man clamd, thought QUIT was an option. You are far from the only one (although I was trying PING, not QUIT). Yes, it is certainly possible to read the man page correctly, but I didn't. --John (one of

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread Matthew.van.Eerde
The Disc Shop wrote: The Disc Shop wrote: LogFile /tmp/clamd.log PidFile /var/run/clamd.pid DatabaseDirectory /var/lib/clamav LocalSocket /tmp/clamd FixStaleSocket User clamav AllowSupplementaryGroups ScanArchive Anyone got any ideas on this? OK, so: clamscan is

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread The Disc Shop
[EMAIL PROTECTED] wrote: OK, so: clamscan is detecting the virus, but clamdscan is not? Please confirm. When was the last time you restarted clamd? Perhaps it's not reloading the virus database whenever freshclam downloads a new update. Can you post your freshclam config as well

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-30 Thread Matthew.van.Eerde
The Disc Shop wrote: [EMAIL PROTECTED] wrote: clamdscan --config-file=/usr/local/etc/clamd.conf abc /var/spool/virtual/thediscshop.com.au/accounts: Access denied. ERROR Well, that's easy. The clamd user doesn't have permission to the file you're trying to scan. Make sure to give the clamd

[Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Richard Hirner
At 21 Nov 2005 13:24:43 -0900, Pete 'Wolfy' wrote: I'm running clamav-milter 0.87 from ClamAV 0.87.1 with sendmail 8.13.5, with a database that is fully up-to-date (main.cvd version 34, daily.cvd version 1182), but for some reason this setup is not catching Worm.Sober.U, and we're getting

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Freddie Cash
On November 29, 2005 09:37 am, Richard Hirner wrote: At 28.11.2005, 21:38 +0100, Richard Hirner wrote: [Sober.U not recognised] The problem was that the signature directory of the FreeBSD port has changed from /usr/local/share/clamav to /var/db/clamav, but I didn't update the freshclam.conf

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Richard Hirner wrote: At 28.11.2005, 21:38 +0100, Richard Hirner wrote: [Sober.U not recognised] The problem was that the signature directory of the FreeBSD port has changed from /usr/local/share/clamav to /var/db/clamav, but I didn't update the freshclam.conf so freshclam

RE: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Matthew.van.Eerde
The Disc Shop wrote: Richard Hirner wrote: At 28.11.2005, 21:38 +0100, Richard Hirner wrote: [Sober.U not recognised] The problem was that the signature directory of the FreeBSD port has changed from /usr/local/share/clamav to /var/db/clamav, but I didn't update the freshclam.conf so

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
[EMAIL PROTECTED] wrote: The Disc Shop wrote: It's not being recognised on my email server either. # sigtool -l|grep -i Sober.U Worm.Sober.U # clamd -V ClamAV 0.87.1/1198/Tue Nov 29 20:05:20 2005 I have checked that the Database Directory is correct in both the clamd.conf and

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Skinner
The Disc Shop wrote: Does clamscan recognize it? clamscan doesn't use the settings in either clamd.conf or freshclam.conf... but clamscan does accept a --database=/var/db/clamav command-line option. Yes, clamscan recognizes it. I ran clamscan on the spool file for one of our email

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Dennis Skinner wrote: The Disc Shop wrote: Does clamscan recognize it? clamscan doesn't use the settings in either clamd.conf or freshclam.conf... but clamscan does accept a --database=/var/db/clamav command-line option. Yes, clamscan recognizes it. I ran clamscan on the spool file for

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Skinner
The Disc Shop wrote: Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Freshclam is apparently working since you have the latest defs, so I'd say your clamd.conf would be more useful (clamd

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Peterson
Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Do this to get the important bits of the files. It ignores comments and empty lines: egrep -v #|^$ clamd.conf /tmp/clam_cnf egrep -v

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread The Disc Shop
Dennis Skinner wrote: The Disc Shop wrote: Then post your config. There is something wrong in it. the clamd.conf or freshclam.conf or both. And should i post it in the body or as an attachment Freshclam is apparently working since you have the latest defs, so I'd say your clamd.conf

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Noel Jones
At 10:46 PM 11/29/2005, The Disc Shop wrote: Anyone got any ideas on this? find / -name daily.cvd | xargs ls -l ___ http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-29 Thread Dennis Peterson
The Disc Shop said: This is the info from my clamd.conf LogFile /tmp/clamd.log PidFile /var/run/clamd.pid DatabaseDirectory /var/lib/clamav LocalSocket /tmp/clamd FixStaleSocket User clamav AllowSupplementaryGroups ScanArchive Anyone got any ideas on this? Does your freshclam.conf

[Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread René Berber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Pete 'Wolfy' Hanson wrote: [snip] Running clamscan --detect-broken finds the message, and generates no errors, but clamav-milter does not find the message when it comes in. clamd.logshows: The key is that clamscan --detect-broken is not the default

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread Tomasz Kojm
On Mon, 21 Nov 2005 17:11:25 -0600 René Berber [EMAIL PROTECTED] wrote: Fix it by editing /etc/clamd.conf, make sure that the following are set: DisableDefaultScanOptions Oh, no. Please do not enable this directive. -- oo. Tomasz Kojm [EMAIL PROTECTED] (\/)\.

Re: [Clamav-users] Re: Worm.Sober.U not being recognized

2005-11-21 Thread Pete 'Wolfy' Hanson
DisableDefaultScanOptions DetectBrokenExecutables No change in behavior with those opts -- Pete Hanson http://www.well.com/user/wolfy http://www.fotolog.net/wolfy ___ http://lurker.clamav.net/list/clamav-users.html