On Thu, 22 Sep 2005 at 11:09:07 +0200, Marco Berizzi wrote: > David Filion wrote: > > > Marco Berizzi wrote: > > > > >Hello everybody. > > >I'm using clam 0.87 with mimedefang. > > > > > >This moring a virus has been slipped through. > > >This is the output from clamdscan: > > > > > >/tmp/photo.zip: OK > > > > > >----------- SCAN SUMMARY ----------- > > >Infected files: 0 > > >Time: 0.143 sec (0 m 0 s) > > > > > >and this is the output from clamscan: > > > > > >photo.zip: Trojan.W32.PWS.Prostor.A FOUND > > > > > >----------- SCAN SUMMARY ----------- > > >Known viruses: 40212 > > >Engine version: 0.87 > > >Scanned directories: 0 > > >Scanned files: 1 > > >Infected files: 1 > > >Data scanned: 0.20 MB > > >Time: 5.939 sec (0 m 5 s) > > > > > >Clearly clamd doesn't recognize it as a virus. > > >Hints? > > > > Did you specify --daemon-notify when you ran/run freshclam? Waiting > for > > the daemon to notice the change and update itself seems to take a > while. > > Yes, I run freshclam --daemon-notify. > I have also restarted both freshclam and clamd. >
Trojan.W32.PWS.Prostor.A signature was added to the database in April 2005, so it's not the matter of delaying in "noticing" the updated database. Unless you have some very old database somewhere and clamd using it. But you may want to verify that there are no some "forgotten" clamd.conf files in the system and, generally, files from old clamav installation. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
