Few HAVP Issues

vito

Hello,
HAVP was working fine on my system till recently.

Was getting this error in the logs
(clamd), uid 0: exited on signal 11
At that point, i turned off HAVP

When i went back to test again and started HAVP, the error disappeared.
HAVP would start to block eicar test files again. BUT, eicarcom2.zip would now pass HAVP. Before it was always blocked.

I rebooted the system and when it came backup, HAVP service was running, nothing was being blocked when testing all the eicar files. (i could however browse the internet)

Had to go into HAVP config and hit save and it seem to start blocking again…but eicarcom2.zip still does not get blocked.

I did have this problem before, but i rebuilt the box.

Thanks in advance.

HAVP .0.90
PF 1.2.3
clamav-0.95.1

EDIT: After another reboot nothing is blocked. Everything is on. PLS see image. thx
looks like someone else might have had the same problem here http://forum.pfsense.org/index.php/topic,24027.0.html

pf.png_thumb

vito

this post comment removed. problem is still what is listed above

vito

Very strange with some things that are happening

I am getting different scan results with different browsers

See the pick below…. Same file, using IE the file can be downloaded. With FireFox it was Blocked

Now, i can get different results with different Virus test files. FireFox might let a file go, and IE will block it.

Good example,
This site now never blocks files from FireFox
http://www.eicar.org/anti_virus_test_file.htm
But IE will block all but eicarcom2.zip

I am also using Squid and Squid Guard.

pf4.png_thumb

pf2.png_thumb

dvserg

You have cached result.

vito

thanks Dvserg,

hmmm, I never noticed this before in my testing

Files would just be blocked all the time when ever i tested….IE and FF

So which is cached, the block result or non blocking result.
Either way, isn't that a little dangerous if a cache will let some files go?
How can the cache be cleared?

Thanks again for your help.

vito

I will assume that this is the cache for HAVP/Squid?
I just tested on a different computer and things are getting by HAVP.
(testing with same test pages)

Now, some things will get blocked…but others are not.

I cleared all cache from IE and FF before testing.