ms, sanesecurity, clamd and freebsd

[Mikael Syska]

Mikael Syska wrote:
> Hi,
>
> Thanks for the help both ...
>
> René Berber wrote:
>> This works with regular sed:
>>
>> clam_db_dir=`"$clamscan" --debug "$test_file" 2>&1 | \
>>                sed -ne 's/\/$//; s/^.*oading databases 
>> from\(.*\)$/\1/p' | head -1`
>>
>> Since only the L in loading is capitalized in the output, getting rid 
>> of the i
>> flag and that letter does the job.
>>   
>
> Well, I just hardcoded the path now ... there seem to be some problems 
> with a traling " " space infront of the path ... like " /var/db/clamav"
>
> Its now downloading fine ... but there seem to be some problems 
> importing the signatures ... havent search the web yet, as I'm on the 
> way to bet now, just wanted to say thanks for the help ... very 
> apriciated.
>
> Output from the log:
> Oct  9 01:28:22 spam02 sanesecurity[97025]: Error executing command 
> <<</usr/local/bin/clamscan --quiet -d 
> /tmp/sanesecurity.XXXXXXXX.mfr7015O/MSRBL-SPAM.hdb 
> /tmp/sanesecurity.XXXXXXXX.mfr7015O/test.file>>>, exit status: 50, 
> output: <<<LibClamAV Error: hex2int() translation problem 
> (109)\nLibClamAV Error: cli_loadhdb: Malformed MD5 string at line 
> 1\nLibClamAV Error: cli_loadhdb: Problem parsing database at line 
> 1\nLibClamAV Error: Can't load 
> /tmp/sanesecurity.XXXXXXXX.mfr7015O/MSRBL-SPAM.hdb: Malformed 
> database\nERROR: Malformed database>>>
> Oct  9 01:28:22 spam02 sanesecurity[97031]: ClamAV had a problem using 
> '/tmp/sanesecurity.XXXXXXXX.mfr7015O/MSRBL-SPAM.hdb' (exit status: 50).
> Oct  9 01:28:22 spam02 sanesecurity[97037]: We will NOT install 
> '/tmp/sanesecurity.XXXXXXXX.mfr7015O/MSRBL-SPAM.hdb' into the database 
> directory.
> Oct  9 01:28:22 spam02 sanesecurity[97045]: Preserving the corrupt 
> file as '/var/db/clamav/MSRBL-SPAM.hdb.bad' for you to check.
>
> see you guys later to day ...
>
> // ouT
this seems to be a problem with the MSRBL-SPAM ....

Seem to catch both "scams" and "Phishing" signatures from the site: 
http://www.sanesecurity.co.uk/clamav/usage.htm

So i'm a happy now ... the other problem will probebly fix it self later ...

Just need to turn on, so mail marked with "clamav" does not get scanned 
to save some CPU power ...

// ouT