Nabble - ClamAV

Clamd & Clamav yield different results

2009-11-28T10:11:16Z

In Silvester's http://silvester.org.uk/OSX/resources/virus_scanning/incoming_email_scan.applescript scripts one can use either scan on incoming Mail.

Here are two excerpts from the corresponding scripts:

For Clamdscan
Code:
set commandline to "/usr/local/clamXav/bin/clamdscan --quiet --stdout --config-file=/usr/local/clamXav/etc/clamd.conf " & POSIX path of file tmpfil
-- display dialog "Clamd command line = " & commandline
do shell script commandline
on error errMsg number exitCode
if (exitCode = 1) then
set background color of thisMessage to red
-- set currentSubject to subject of thisMessage
-- set subject of thisMessage to "[**VIRUS** - ClamAV]" & currentSubject
move thisMessage to mailbox "_Quarantine"

for Clamscan
Code:
set commandline to "/usr/local/clamXav/bin/clamscan --quiet --stdout " & POSIX path of file tmpfil
-- display dialog "Clamd command line = " & commandline
do shell script commandline
on error errMsg number exitCode
if (exitCode = 1) then
set background color of thisMessage to red
-- set currentSubject to subject of thisMessage
-- set subject of thisMessage to "[**VIRUS** - ClamAV]" & currentSubject
move thisMessage to mailbox "_Quarantine"

Since I find NO "clam.conf" but I DO have a "clamd.conf", the two scan areas on the first lines above are slightly different.

I found a Known virus file (which is zipped) .. clamscan finds it; BUT clamdscan DOES not.

Is there a reason for this?

Since finding this difference, I now use the clamscan script even though it IS somewhat slower....

Thanx in advance...
Jim B
======================================
Turkey Day,,,, 11-26-09
EDIT: A 2nd test: Used clamXav to update at 12:42
Code:
Thu Nov 26 12:42:19 2009 -> Database updated (659735 signatures) from db.us.clamav.net (IP: 64.246.134.219)
Thu Nov 26 12:42:19 2009 -> Clamd successfully notified about the update.

Then saw that clamd, being notified, performed a DB update:
Code:
Thu Nov 26 12:42:19 2009 -> Reading databases from /usr/local/clamXav/share/clamav
Thu Nov 26 12:42:22 2009 -> Database correctly reloaded (659708 signatures)

Difference of 27 entries... but not the same.

The clamav DB update source varies from an IP of 81.x.x.x to 64.x.x.x to 217.x.x.x
So I assume that they are not in sync with one another?

I NEVER get the clamav DB from IP 81.x.x.x :
Code:
Trying host db.us.clamav.net (81.173.192.234)...
Thu Nov 26 12:42:09 2009 -> nonblock_connect: connect timing out (30 secs)
Thu Nov 26 12:42:09 2009 -> Can't connect to port 80 of host db.us.clamav.net (IP: 81.173.192.234)
Thu Nov 26 12:42:09 2009 -> Trying host db.us.clamav.net (64.246.134.219)...

Then the IP at 64.x.x.x gets the .diff failure forcing the update of the <daily.cvd> file using the same IP 64.x.x.x address.

Can a difference of 27 entries cause clamdscan miss a virus that clamscan can find?

Still confused...

BTW I am not certain that the file content difference are *actual* signature entries..

Any comments?
_________________
V2.0.4+0.95.3 (with clamd)
OS 10.6.2/24" iMac/2GB/320GB/VMWare w/ W2K & WIN 7RC/Developer tools/Xcode 3.2

Last edited by Jim babcock on Thu Nov 26, 2009 1:12 pm; edited 3 times in total
========================================================
Jim Babcock Ph: 512-310-1968
Babcock Consulting Fax: 608-541-6206
1802 Gray Oak Dr mailto:babcock@...
Round Rock, Tx 78681

Visit J & B Imaging Services' Web Page at: http://www.jabis.com

Frederick Brooks: "I happily use a Macintosh. It's not been equalled
for ease of use and I want my computer to be a tool, not a challenge."
[Former IBMer Brooks is the author of 'The Mythical Man Month']
========================================================

_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml

From forum: clamav-users

Update (daily: 10091)

2009-11-28T05:59:51Z

ClamAV database updated (28 Nov 2009 08-57 -0500): daily.cvd
Version: 10091

Submission-ID: 11802376
Sender: Virus Total
Submission notes: Already detected as Trojan.Agent-128980
Added: No
Virus name alias: Trojan.Generic.2700622 (Bitdefender)

Submission-ID: 11809110
Sender: Virus Total
Sender: Bruno Victal
Submission notes: Already detected as Trojan.IRCBot-3626
Added: No
Virus name alias: Backdoor.Win32.IRCBot.gen (Kaspersky AVP), BackDoor.IRC.Usbrun.origin (Drweb), Generic.Malware.SIYBdldg.DD13DF28 (Bitdefender)

Submission-ID: 11809177
Sender: VirScan.org
Submission notes: Same as in Submission-ID 11234550
Added: No

Submission-ID: 10775531
Sender: Virus Total
Sender: David Peters
Submission notes: Already detected as Trojan.Vundo-29646
Added: No
Virus name alias: Trojan.Win32.Plapon.rc (Kaspersky AVP), Trojan.Generic.2496286 (Bitdefender)

Submission-ID: 11819848
Sender: Virus Total
Submission notes: Already detected as Trojan.Downloader-82421
Added: No
Virus name alias: Gen:Trojan.Heur.TDss.fu4@hGsQv7n (Bitdefender)

Submission-ID: 11820949
Sender: Virus Total
Submission notes: Already detected as Trojan.Spy-66830
Added: No
Virus name alias: Trojan.Generic.2714899 (Bitdefender)

Submission-ID: 11822748
Sender: VirScan.org
Submission notes: Same as in Submission-ID 11567409
Added: No

Submission-ID: 11828238
Sender: Symantec
Submission notes: Same as in Submission-ID 11882680
Added: No

Submission-ID: 11833420
Sender: Virus Total
Submission notes: Already detected as Trojan.Fraudpack-1785
Added: No
Virus name alias: Trojan.Generic.2682713 (Bitdefender)

Submission-ID: 11841377
Sender: VirScan.org
Submission notes: Same as in Submission-ID 11567409
Added: No

Submission-ID: 11845753
Sender: Virus Total
Submission notes: Already detected as Trojan.Vundo-29459
Added: No

Submission-ID: 11850256
Sender: Symantec
Submission notes: Already detected as Trojan.Vundo-29391
Added: No
Virus name alias: Trojan.Generic.2759400 (Bitdefender)

Submission-ID: 11857124
Sender: Virus Total
Submission notes: Already detected as Trojan.Spy-66859
Added: No
Virus name alias: Gen:Trojan.Kates.by8@a8aXvvai (Bitdefender)

Submission-ID: 11857163
Sender: Virus Total
Submission notes: Already detected as Trojan.Spy-66816
Added: No
Virus name alias: Trojan.PWS.Kates.H (Bitdefender)

Submission-ID: 11857215
Sender: Virus Total
Submission notes: Already detected as Trojan.Spy-66828
Added: No
Virus name alias: Gen:Trojan.Kates.by8@a8aXvvai (Bitdefender)

Submission-ID: 11857284
Sender: Virus Total
Submission notes: Already detected as Trojan.Spy-66846
Added: No
Virus name alias: Trojan.PWS.Kates.H (Bitdefender)

Submission-ID: 11867463
Sender: Symantec
Submission notes: Already detected as Worm.VB-1134
Added: No
Virus name alias: Trojan.Loader.AX (Bitdefender)

Submission-ID: 11869192
Sender: ShadowServer
Submission notes: Same as in Submission-ID 11872453
Added: No

Submission-ID: 11875105
Sender: OITC
Submission notes: Same as in Submission-ID 11876254
Added: No

Submission-ID: 11977742
Sender: Virus Total
Submission notes: Already detected as Trojan.Mybot-11814
Added: No
Virus name alias: GenPack:Generic.Malware.G!I!!FLWX!!Bprng.8632924B (Bitdefender)

Submission-ID: 11982941
Sender: Virus Total
Submission notes: Already detected as Trojan.Bancos-6598
Added: No
Virus name alias: Trojan.Generic.670474 (Bitdefender)

Submission-ID: 11990116
Sender: Sunbelt
Submission notes: Already detected as Trojan.Agent-96030
Added: No
Virus name alias: Trojan.Swizzor.2 (Bitdefender)

Submission-ID: 11990118
Sender: Sunbelt
Submission notes: Already detected as Trojan.Agent-73838
Added: No
Virus name alias: Backdoor.Bot.68422 (Bitdefender)

--
Best regards,
Christoph

_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-virusdb

Nabble - ClamAV

Clamd & Clamav yield different results

Update (daily: 10091)

Re: Beginners Question

Beginners Question

Re: SubmitDetectionStats Error

Odd error message about the integrity of the main.cvd

Update (daily: 10089)

Update (daily: 10090)

Update (daily: 10088)

Update (daily: 10087)

Update (daily: 10086)

Update (daily: 10085)

Update (daily: 10084)

Re: sorry this is a bit brief...

Update (daily: 10083)

Update (daily: 10082)

Re: sorry this is a bit brief...

Re: ArchiveBlockEncrypted.

Update (daily: 10081)

Re: Detection Reporting

Update (daily: 10079)

Update (daily: 10078)

Update (daily: 10077)

Re: ArchiveBlockEncrypted.

sorry this is a bit brief...

Update (daily: 10076)

Update (daily: 10075)

Update (daily: 10074)

Update (daily: 10073)

Update (daily: 10072)

Detection Reporting

Update (daily: 10071)

Update (daily: 10070)

Re: ArchiveBlockEncrypted.

Re: Capturing message header data