Mandi! Marco Gaiarin
In chel di` si favelave...
> > as it is a pattern, not a path, might work ;-)
> Ok, works. But as i've stated yesterday, if some user create a
> ``quarantena'' folder somewhere, that folder are not scanned. This is
> not so good...
> There's some way that i can match an exact path? Some ``standard''
> regular expression library are used, like ereg, or shell globbing, ...
> that i can start playing with?
I've fiddled a bit within... seems that path specified in --exclude-dir
are relative, not absolute, so if you have to scan /srv and exclude
/srv/quarantena, you have to do:
clamscan --recursive --exclude-dir=/quarantena /srv
and not
clamscan --recursive --exclude-dir=/srv/quarantena /srv
as i was supposing. This is rather suboptimal, because every user can
create a quarantena user and match occur.
The only solution seems to create a quarantena folder out of scan path,
but why there's a --exclude-dir options? ;)
> > > Also, i've noted that even if i've put --no-mail, this script quarantine
> > > a Thunderbird mailbox, that is in unix mailbox format.
> > > What i'm missing here?
> i'm doing something wrong or can i do something to prevent the
> --no-mail to fail?
Still no answer... i'll put on CC the bugreport address of clamav,
hoping help.
trinity:/srv/quarantena# file arrivo.mbx
arrivo.mbx: ISO-8859 mail text, with CRLF line terminators
trinity:/srv/quarantena# clamscan --no-mail arrivo.mbx
arrivo.mbx: JS.Fortnight.B.1 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 44053
Engine version: 0.88
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.38 MB
Time: 0.726 sec (0 m 0 s)
I've tried to scan unix mailboxes, seems that the trouble came from the
windows CRLF termination, as:
trinity:/srv/quarantena# file /home/gaio/.inbox
/home/gaio/.inbox: ASCII mail text
trinity:/srv/quarantena# clamscan /home/gaio/.inbox
/home/gaio/.inbox: Eicar-Test-Signature FOUND
----------- SCAN SUMMARY -----------
Known viruses: 44053
Engine version: 0.88
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Time: 0.532 sec (0 m 0 s)
trinity:/srv/quarantena# clamscan --no-mail /home/gaio/.inbox
/home/gaio/.inbox: OK
----------- SCAN SUMMARY -----------
Known viruses: 44053
Engine version: 0.88
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.01 MB
Time: 0.536 sec (0 m 0 s)
trinity:/srv/quarantena# clamscan --version
ClamAV 0.88/1281/Wed Feb 8 20:59:33 2006
from a debian sarge, taken from volatile.
--
dott. Marco Gaiarin GNUPG Key ID: 240A3D66
Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/
Polo FVG - Via della Bontà , 7 - 33078 - San Vito al Tagliamento (PN)
marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
