Mailing List Archive by Gossamer Threads http://www.gossamer-threads.com/lists/clamav/devel/ en-us (c) Gossamer Threads Inc. All rights reserved. 12 Feb 2012 16:14:57 -0800 120 75 23 http://www.gossamer-threads.com/lists/clamav/devel/ http://www.gossamer-threads.com/images/lists/rss_logo.jpg I am receiving "ERROR: Communication error" from clamd while scanning 8.5T NFS-mount in Debian stable using clamdscan. I did not get more informative 12 Feb 2012 09:21:01 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54276 I found a .NEF-file with vulnerability "Dos.Flip.Gen". What does that malware do? What is usually the best way to investigate virus names, which are u 12 Feb 2012 01:20:05 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54271 Hello All, I recompiled source code when improved source code of Clamav. I using step as built source code. $./configure $make $make install Compile- 11 Feb 2012 00:52:23 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54258 Hello All, I debug code of clamav. Aho-Corasick( AC) Algorithms concepts for matching between virus and signature files. Step for AC is build 01 Feb 2012 19:53:19 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54155 Hi everyone, I am pursuing masters degree. I am doing my project in enhancing clamav application . can anyone state me, list of enhancement that can b 31 Jan 2012 01:21:19 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54146 Hello All, After i built code of clamscan success, Visual Studio v.2010 debug by pass "-dC:\clamav-dev\win32\Win32\Debug\database\ C:\clam 21 Jan 2012 21:40:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/54056 Hello All, I built code of clamav success on M$ Virtual C++ 10. I have an idea to build the unit_test package of clamav for testing modules 09 Jan 2012 21:03:04 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53984 Hello All, Error present cannot found file name freshclam.conf when type command line update a signature of database. It's not like freshclam on Linu 08 Jan 2012 08:04:53 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53974 Hello All, I built Clamav on M$ win32 environment, But present error "Cannot Open include file: 'libclamav/version.h': No such file or 26 Dec 2011 20:39:31 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53890 Hi, In the thread http://lurker.clamav.net/message/20111212.083121.71a17ccd.en.html I asked about memory usage when scanning a zip file. I deci 21 Dec 2011 08:07:46 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53855 I read the Faq, but I couldn`t find how to complie the whole program, is there someone had successful experence? Thank you! __________________________ 13 Dec 2011 07:45:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53816 Hi, I'm having a 'problem' with scanning a large zip file. What appears to be happening is that clamav loads the entire file into memory (RSS not V 12 Dec 2011 00:31:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53802 There is a problem building 0.97.3 on FreeBSD with external llvm, a user has reported 0.97.2 has the same problem. Follow the error message: gmake[3] 17 Oct 2011 16:37:53 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53355 Hiya, (that's on debian testing amd64 with libclamav6 0.97.2+dfsg-1) I had a few c-icap crashes on scanning some debian packages for firefox (for in 07 Oct 2011 06:33:46 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53275 Hello All, I debug clamscan programs by insert a input test to it. I have question on function for check match string between virus and signature on 29 Sep 2011 11:24:08 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53215 Hello All, I try to build ClamAV by ./configure include with --enable-debug flag. Because I would to found step AC algorithms for matching b 21 Sep 2011 09:11:56 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53139 I intend to translate clamAV interface for linux and windows into ukrainian. i also want to translate clamAV website into ukrainian later on if its po 21 Sep 2011 04:24:04 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53136 Hi list. I'm in trouble building ClamAV 0.97.2: make[4]: Entering directory `/usr/local/src/clamav-0.97.2/libclamav' GEN version.h.tmp GEN 16 Sep 2011 02:29:23 -0800 http://www.gossamer-threads.com/lists/clamav/devel/53079 Hi, I am trying to create a signature that match a pattern, but it should not match when a specific pattern is present. From the documentation: . ! 26 Aug 2011 04:07:45 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52800 A FreeBSD user reported me he got following while building 0.97.2 on a recent -current system: PASS: check_clamav PASS: check_freshclam.sh PASS: chec 02 Aug 2011 07:23:05 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52657 Hello, I propose a possible speed-up scan (as I think that hashing is faster than scanning) The idea comes from security software like WinSonar ( ht 12 Jul 2011 02:18:20 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52476 Hi, I am a newbie to ClamAV so require help please. I am doing a research project and would like to evaluate the BM and AC algorithms used by Clam 10 Jul 2011 15:00:55 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52453 Hi! I see that Immunet uses libclamav.dll. Doesn't this violate the clamav license? For example, I'd like to build my own closed source commercial ant 08 Jul 2011 14:26:32 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52438 Hello, I can build 20110704 snapshot with external llvm-2.9 on FreeBSD 8.2 without problems, but on 0.97.1 i got the following error: gmake[3]: Leav 04 Jul 2011 17:32:37 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52400 Hi people, A FreeBSD user sent a PR [1] reporting a problem started to happen after recently update it to 0.97.1. Can you please take a look and let 29 Jun 2011 07:24:09 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52351 Seems a bit odd that I've disabled milter, yet it claims it's being built: configure: Summary of detected features follows OS 29 Jun 2011 00:21:09 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52334 Hi, In a completely isolated network environment, I want to setup my own CVD-Database server and create my own special signatures. If looking at the 20 Jun 2011 19:48:44 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52270 Hello guys, Chris Rees (also cc'ed) let me know he found problems building clamav on FreeBSD 9.0-CURRENT i386. Here you can find the log [1] and Chri 20 Jun 2011 09:57:30 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52262 Hi there, We have an option on FreeBSD ports collection to build clamav using llvm that was already installed in the system. It reduces a lot the tim 19 May 2011 05:56:53 -0800 http://www.gossamer-threads.com/lists/clamav/devel/52070 Hi, The attached patch is an implementation of the async reload feature that was mentioned on clamav-users some time ago by Vivien Raoul. It address 28 Mar 2011 07:26:44 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51797 > > On Fri, 4 Mar 2011 11:15:53 -0500 Liu Yang <yangliutww@gmail.com> wrote: > > Does ClamAV have signatures dedicated to scan music and video files i 05 Mar 2011 07:22:26 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51570 Does ClamAV have signatures dedicated to scan music and video files in format such as mp3, flv, f4v? Also, why the number of jpeg related signatures i 04 Mar 2011 08:15:53 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51563 Hi, Referring to threads at: http://lurker.clamav.net/thread/20110228.124343.f4b93b47.en.html#20110228.124343.f4b93b47 http://lurker.clamav.net/threa 28 Feb 2011 06:47:07 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51523 Hi, There is a patch for clamav on FreeBSD at the following url. http://www.mail-archive.com/clamav-devel@lists.clamav.net/msg02775.html It seems th 24 Feb 2011 05:35:37 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51488 Hi guys, A FreeBSD user reported a problem when he upgraded to 0.97 as you can see at [1]. Does it make any sense for you? Thanks [1] - http://www. 23 Feb 2011 04:09:33 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51479 Hello, I've made a few tests lately to embed malwares inside UNIX packages like RPM or DEB packages. Once done, I scanned the packages with many anti 15 Feb 2011 00:20:31 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51395 I have found a publicly available file that triggers the very long scan time bug. http://llvm.org/devmtg/2007-05/06-Spencer-HLVM.pdf LibClamAV Warni 19 Jan 2011 04:04:47 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51142 Hi, I'm reading the clamav source code, but the following in libclamav/others.h confused me: #define CLI_MAX_ALLOCATION (182*1024*1024) The number 1 17 Jan 2011 00:41:24 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51125 All -- Just wanted to give you all a quick update. The ClamAV blog, after a two year hiatus, is now back. http://blog.clamav.net We'll keep this u 07 Jan 2011 13:53:41 -0800 http://www.gossamer-threads.com/lists/clamav/devel/51073 The public beta for ClamAV for Windows 3.0, which includes full integration of the ClamAV engine into the Immunet Protect product is now open.  If you 20 Dec 2010 10:31:06 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50955 Hi, It seems that ClamAV 0.96.5 appends some sort of hash to the virus name. Whereas before, our tests would return a name like "Eicar-Test-Signature 01 Dec 2010 07:36:29 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50819 I have three questions about Heuristic Scan in ClamAV . 1.What type of file will be scanned as a Heuristic scan? 2.How can I configure the Heuristic f 30 Nov 2010 01:46:49 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50808 All -- This is just an announcement to let the users of our OpenSource products know that we have a new community manager. Over the past year or s 15 Nov 2010 10:38:41 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50678 Is there an accurate way to measure the memory consumption of clamav database? The methods I used are top and /proc/pid/status, but I feel there might 28 Oct 2010 09:03:38 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50535 the only problem in Bochs and qemu is they are built for supporting full virtualization . so emulate the hardware and the the cpu and they don't suppo 24 Oct 2010 06:29:26 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50503 Hello everyone First I want to say it's a great antivirus and seems it will have a good future Second I want to say when I read some portions of the 23 Oct 2010 16:11:20 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50497 Dear Users, we're going to release a new version of ClamAV on Monday, October 25. ClamAV 0.96.4 will fix some issues with the PDF parser, logical sig 19 Oct 2010 07:24:28 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50453 Hi. Starting from the last upgrade (0.96.3 on debian) freshclam randomly chooses between ipv6/ipv4 connecting to the name that has addresses in both 04 Oct 2010 05:31:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50283 Hi, I just committed some changes to configure and the bytecode2llvm.cpp to allow building with an external LLVM. This will allow you to build agains 28 Sep 2010 06:57:17 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50209 I'm trying to build 0.96.3, but configure keps getting stuck in a tight loop whilst "checking for CVE-2010-0405..." /Per Jessen, Zürich _________ 24 Sep 2010 08:33:39 -0800 http://www.gossamer-threads.com/lists/clamav/devel/50168 Hi all, The attached patch against Clamav-0.96.2 adds a ClamukoIgnoreSuperuser option to Clamukofs. If set to "yes", files that are opened by proces 09 Sep 2010 07:46:23 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49855 Hi all, I am planning to add the ability of using compute devices for signature matching to ClamAV. I have already implemented the Aho-Corasick algor 04 Sep 2010 11:54:17 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49787 Hi, I want to know the max size of the daily.cvd. I would like to just use daily.cvd instead of both of daily.cvd and mail.cvd because my system has a 03 Sep 2010 21:44:35 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49778 Hello, I'd like to add the ability to let end users automatically upload suspicious files from a GUI interface. I have two questions about this: 1. 28 Aug 2010 07:01:34 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49671 I am a beginner of ClamAV and I am working on a malware detection project. Recently I was reading the ClamAV source code and have some questions. One 27 Aug 2010 12:49:02 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49669 Hi all! Does anybody know what is the following signature mean (especially the last two sections)? VBS.Redlof-1:3:*:666f73b2079706f735b695d3d79 26 Aug 2010 19:33:44 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49652 Hi, Can somebody please explain to me how ClamAV does file type filtering? here is exactly what I need in details. My understanding is that ClamAV's 16 Aug 2010 02:42:54 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49451 all older versions and dependancies have been removed, config files updated per instructions. Tested on PowerPC and Intel based Macs with the same 14 Aug 2010 05:35:42 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49437 On 7/28/2010 6:18 PM, thyago wrote: > I'm researching ways of updating a signature database on-the-fly, so the way > clamAV does it, can really help m 13 Aug 2010 23:45:32 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49431 This patch adds the "ClamukoBlockAccess" config directive to clamd.conf. When this directive is set to "yes" (which is the default), Clamuko will in 09 Aug 2010 06:15:01 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49374 This patch adds an x64 target to the Windows build. (socket code in this build is not guaranteed to work due to casting the 64-bit SOCKET type to a 01 Aug 2010 05:21:10 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49305 The attached patch adds support for running clamd & freshclam as Windows services. freshclam/clamd --install will install the service. 31 Jul 2010 09:03:41 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49303 I'm researching ways of updating a signature database on-the-fly, so the way clamAV does it, can really help me out... I mean, what structures are the 28 Jul 2010 16:18:57 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49281 Hello, I am actually working on the ClamAV source code. I would like to make some modifications on the ""ArchiveBlockEncrypted"" option. When it is e 19 Jul 2010 07:51:36 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49187 Hi, Are all patterns which contain the wildcards scaned by AC matcher? The others scaned by BM matcher? Does AC algorithm more effecient than BM and 01 Jul 2010 20:11:31 -0800 http://www.gossamer-threads.com/lists/clamav/devel/49002 Hi all~ Thank you for solving my problem before. I still have some other questions when analysing the codes of ClamAV. Could anybody help me again 29 Jun 2010 20:45:15 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48970 Hi all~ When the ClamAV scanning a PE file, does it use the LLVM and why use it? Best Regards. _______________________________________________ http: 27 Jun 2010 19:43:22 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48937 Sorry, I may not express clearly. I want to know the what the functions in filter.c file do. I think it build a filter before scaning and get a positi 26 Jun 2010 17:57:28 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48931 Hi all~ I am a freshman of clamav and is reading the code of clamscan recently. I don't know why we need a filter? Does it filter some files which ca 24 Jun 2010 20:56:48 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48922 Hi, Are new viruses always added to the end of the database files (in both main.* and daily.*)? From few samples, I see that new viruses are appended 06 Jun 2010 01:00:39 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48728 Is there an email-address where I can send my samples automatically to ClamAV? I am collecting malware with automated scripts and checking those with 05 Jun 2010 01:20:35 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48719 Hi, I first thought that the daily signatures are added to the main ones every while ( and thus removed from the daily.cvd). After checking, it does 27 May 2010 08:51:20 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48638 Hi, Can you please point me to a paper or any other source that could help in understanding the Boyer-Moore implementation in ClamAV? Is it very diff 19 May 2010 11:30:28 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48483 Hi, Is the virus database updated through a repository (for example svn or cvs)? I would like to see how virus database changes over time. Thanks, ~ 17 May 2010 12:21:28 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48451 Hi there, I'm sending this to clamav-devel rather than clamav-users as I suspect I may have missed something during the configure/compile phase rat 17 May 2010 11:26:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48447 Is this a bug in ClamAV (filtering.c)? case CLI_MATCH_NIBBLE_LOW: spec->start = (p & 0xf); spec->end = 0xf0 | spec- 14 May 2010 10:59:06 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48419 Hi, I have two questions. Thanks in advance for answers. 1- MAXSOPATLEN constant was commented in more than one location to contain the value 32 but 12 May 2010 10:53:50 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48354 Hi there, On Fri, 7 May 2010, Luca Gibelli wrote: > We apologise for the inconvenience. http://www.mail-archive.com/clamav-users@lists.clamav.net/m 07 May 2010 15:05:05 -0800 http://www.gossamer-threads.com/lists/clamav/devel/48246 Just curious - my 0.95.3 libclamav was about 2Mb, the new 0.96 is 12Mb - did I possibly do something wrong in the build? /Per Jessen, Zürich _____ 25 Apr 2010 07:58:31 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47936 Does ClamAV use Aho-Corasick algorithm to match files against static signatures and Boyer-Moore against signatures that have *'s and ??'s ? Thanks m 24 Apr 2010 13:39:15 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47923 Hi, there-- I sincerely apologize if this has been mentioned before. Very few results come up when I search for anything related to ssn's on the a 23 Apr 2010 19:24:40 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47887 Someone asked me about using clamav and coldfusion to scan uploaded attachments so I threw together something that seems to be fast enough to be u 22 Apr 2010 08:18:35 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47826 Hi, Since it's a platform i don't have access, i'll just show you the error and you tell me if you have any idea what could be happening. http://poi 22 Apr 2010 04:10:21 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47813 I've noticed that if I use clamscan to scan a file, it always takes around 3.7 seconds no matter the file content, type, or even size (unless it is re 18 Apr 2010 10:30:17 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47513 The changes make it difficult to understand if clamd is functioning properly because after the upgrade from 0.92 I see log entries that make no se 18 Apr 2010 08:06:57 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47505 Hi, Does ClamAV do code emulation to detect viruses/worms? Thanks, ~Moe _______________________________________________ http://lurker.clamav.net/ 18 Apr 2010 06:10:44 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47498 It would be very nice to see hashes and possible CVEs in submissions in virusdb-mailinglist. Every submission should have at least MD5-, SHA1-checksu 16 Apr 2010 09:15:10 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47276 Hi, I just had a chat on #clamav with 2 people having problem with ClamAV 0.96 on FreeBSD 6.2. (everything was OK on FreeBSD 6.3) The symptom is th 16 Apr 2010 07:00:25 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47239 On 16/04/2010 2.03, Steve Holdoway wrote: > On Thu, 2010-04-15 at 22:27 +0300, Török Edwin wrote: >> Hi, >> >> The EOL signature for ClamAV <= 0.94. 15 Apr 2010 18:29:25 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47188 Hi, The EOL signature for ClamAV <= 0.94.2 is now live (daily 10749). Best regards, --Edwin _______________________________________________ http://l 15 Apr 2010 12:27:34 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47183 http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/145509 Any idea? -- Renato Botelho _______________________________________________ http://lurker.c 13 Apr 2010 08:59:37 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47122 After upgrade FreeBSD ports tree to 0.96, a user filled this PR: http://www.freebsd.org/cgi/query-pr.cgi?pr=145520 Would be nice if clamav checks in 09 Apr 2010 09:06:44 -0800 http://www.gossamer-threads.com/lists/clamav/devel/47069 Sun Studio Compiler finds two buglets in 0.96. ********************************** CC bcrun.o "bcrun.c", line 240: warning: initializer does n 07 Apr 2010 12:17:02 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46988 Hi, I have a question about the CVD that will "contain a special signature which disables all clamd installations older than 0.95." What exactly wil 07 Apr 2010 11:21:49 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46980 I'm preparing everything to update to 0.96 on FreeBSD ports tree and I noted 0.96 is still failing (checks) on 6.x This program built for amd64-portb 05 Apr 2010 04:50:42 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46954 Hi, I am newbie to ClamAV and want to know what is the scanning algorithm currently used by ClamAV. I would appreciate it if somebody guides me to th 02 Apr 2010 11:39:17 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46945 Hi! The ClamAV bytecode compiler version 0.10 is now available. You can get it by using one of these commands: $ git clone git://git.clamav.net/git/ 12 Mar 2010 14:06:49 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46745 A FreeBSD user contacted me reporting a problem building clamav under FreeBSD 9. I reproduced it locally, using 20100308 snapshot: [----------] 3 tes 11 Mar 2010 11:54:25 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46710 Hi, I noticed the announcement of the bytecode interpreter in the 0.96-rc1 announcement. That feature took me utterly by surprise. Could anyone pro 10 Mar 2010 12:54:28 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46683 Hello, I'd like to ship ClamAV with my commercial closed-source SMTP proxy to provide virus scanning capabilities out of the box. I use one of Win32 09 Mar 2010 01:34:20 -0800 http://www.gossamer-threads.com/lists/clamav/devel/46650