Another thing, If I force troot->ac_only=0
if(troot) {troot->ac_only=0;printf("\ntroot->ac_only IN TROOT!!!%d \n",troot->ac_only); if(troot->ac_only || (ret = cli_bm_scanbuff(upt, length, ctx->virname, troot, offset, ftype, desc)) != CL_VIRUS) ret = cli_ac_scanbuff(upt, length, ctx->virname, NULL, NULL, troot, &tdata, offset, ftype, desc, ftoffset, acmode, NULL); printf("\nRET IN TROOT!!!%d \n", ret); if(ret == CL_VIRUS) { <<cut>> It doesnt change anything, I get the same results for troot->ac_only=1: ---------output------------ troot->ac_only IN TROOT!!!0 <<<<<<<<<<<cli_ac_scanbuff>>>>>>>>>>>><<<<<<<<<<<root->ac_root6488480>>>>>>>>>>>> RET IN TROOT!!!0 groot->ac_only IN GROOT!!!0 <<<<<<<<<<<cli_bm_scanbuff>>>>>>>>>>>>><<<<<<<<<<<root6346288>>>>>>>>>>>> RET IN GROOT!!!1 Inside cli_scanraw function After inst. RET: 1 <|> ../test/vir/tinyVirus: TinyVirus.UNOFFICIAL FOUND cl_scandesc function has been called. RET:1 -----------Extended SCAN SUMMARY ----------- Known viruses: 1 Engine version: 0.94.1 Scanned directories: 0 Scanned files: 1 Infected files: 1 Aco-Corasick: ENABLEBoyer-Moore: DISABLEData scanned: 0.00 MB Time: 0.004 sec (0 m 0 s) ----------end-output-------------- If I force groot->ac_only to 1 I got 'segmet fault' (seg fault is another funciotn - cli_scanraw) ---------------code--------------- if(!ftonly) {(groot->ac_only=1; printf("\ngroot->ac_only IN GROOT!!!%d \n",groot->ac_only); if(groot->ac_only || (ret = cli_bm_scanbuff(upt, length, ctx->virname, groot, offset, ftype, desc)) != CL_VIRUS) ret = cli_ac_scanbuff(upt, length, ctx->virname, NULL, NULL, groot, &gdata, offset, ftype, desc, ftoffset, acmode, NULL); printf("\nRET IN GROOT!!!%d \n", ret); if(ret == CL_VIRUS) { ---------------end-code----------- Does anybody tried to change this flags? Swap scanning algorithms? Thanks in advance, Tom _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net