On Wed, 1 Dec 2010 17:53:14 +0200 Török Edwin <ed...@clamav.net> wrote:
> Where do you see this? clamd logs, clamdscan output, clamscan output? We connect to clamd directly on the UNIX-domain socket and send a SCAN command (not CONTSCAN). When I configure it to listen on a TCP socket and telnet by hand, I get this: $ telnet localhost 3310 Trying 127.0.0.1... Connected to localhost.localdomain. Escape character is '^]'. SCAN /tmp/eicar-test /tmp/eicar-test: Eicar-Test-Signature(8fd1f39c7e4cf58dfa8c0618364779c2:70) FOUND Connection closed by foreign host. When I use CONTSCAN instead of SCAN, I get the same result (with the hash info). When I trace clamdscan, I see it uses the new(ish) zCONTSCAN zero-terminated command. Perhaps that one behaves differently? > It should only do that if you have 'ExtendedDetectionInfo Yes' in > clamd.conf, which is not the default. Do you have that in clamd.conf? No, we do not. > Also make sure that both your clamd and libclamav are 0.96.5. That's the case. Regards, David. _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
