Good point. I think I'm going to exclude .vmdk files and rely on scans inside the virtual machines.
>From: "Steffen Heil" <[EMAIL PROTECTED]>
>Reply-To: ClamAV users ML <[EMAIL PROTECTED]>
>To: "'ClamAV users ML'" <[EMAIL PROTECTED]>
>Subject: AW: AW: [Clamav-users] VMWARE and False positives?
>Date: Wed, 15 Dec 2004 18:24:07 +0100
>
>Hi
>
> > I ran a Clamav scan inside the Windows 2000 Vmware machine and it came
>back clean --zero viruses-- whereas the external scan (of the vmdk file)
>detected the virus!
>
>This does not tell you, that the is no virus fragment left in unallocated
>slack space in the virtual file system.
>If the virus is there, clamav inside the VM cannot find it. However external
>scanning can find it.
>
>Maybe you can try clamscan /dev/hda1 inside the VM to include slack space
>for scanning.
>(However, I have never done so and do not know about it's consequences. Do
>at your own risk.)
>
>Regards,
> Steffen
><< smime.p7s >>
>_______________________________________________
>http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
