Re: [Snort-inline-users] Show what Snort-inline is able to do

[Will M. <wil...@gm...>]

Did you actually download unzip and try to move the extracted viri
through the inline box?  Remember, we can't deal with zipped files and
all files on this site are zipped.  We cannot unzip because we are
only scanning fragments of files.

Regards,

Will

On 9/26/05, Holger Moskopp <gan...@mo...> wrote:
>  Hi,
>
>  i tested in the meantime a lot of virii from that page.
>  But no one was alerted by ClamAV and Snort-inline.
>
>  Could it be, that ClamAV isn`t correct installed?
>  I got a Debian Sarge and installed it with apt-get install clamav.
>  but there is only the viridataset and the freshclamavdeamon.
>  Could it be that i need the deamon clamd?
>
>  How could i find out, if clamav is correct installed for the use
>  of Snort-inline?
>
>  Many greetings
>  Holger
>
>  Cole schrieb:
>
> Hi.
>
> This website has a collection of virii. http://vx.netlux.org/ The problem=
 is
> that clamav does not
> pickup a large amount of virii on the actual page, but it does pickup qui=
te
> a lot. So try it out
> with that.
>
> /Cole
>
> -----Original Message-----
> From: sno...@li...
> [mailto:sno...@li...] On
> Behalf Of Holger Moskopp
> Sent: Wednesday, September 07, 2005 10:14 PM
> To: Victor Julien
> Cc: sno...@li...
> Subject: Re: [Snort-inline-users] Show what Snort-inline is able to do
>
> Hmm? and where can i get a Virus for testing?
>
> Or is there a known webpage with a virus?
>
>
> Victor Julien schrieb:
>
>
>
>
>  Will wrote that eicar changed their side. How can i test if ClamAV work?
>
>  I think the easiest way would be to put a virus on an ftp-server and
> then try to download it through the snort_inline firewall.
>
> Good luck,
> Victor
>
>
>
>
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practic=
es
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing & Q=
A
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>
>
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practic=
es
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing & Q=
A
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
>
>
>