Bill Landry wrote the following on 9/22/2007 1:13 PM -0800: > Noel Jones wrote the following on 9/22/2007 1:07 PM -0800: > >> At 02:59 PM 9/22/2007, Bill Landry wrote: >> >> >>> But alias, no such luck, as clamscan deletes the >>> temp file even when the "--leave-temps" flag is used... :-( >>> >>> Bill >>> >>> >> I believe you must compile with --enable-debug for the --leave-temps >> flag to work. >> >> > Hmmm, well if that's the case, then it should at least be mentioned in > the clamscan man page, which currently only states: > > --leave-temps > Do not remove temporary files. In fact, even in the signatures.pdf document (http://www.clamav.org/doc/latest/signatures.pdf), it shows the following text without ever mentioning that clamav must first be compiled with --enable-debug: ========== 3.2 Compressed Portable Executable files
If the file is compressed with UPX, FSG, Petite or other executable packer (supported by libclamav) run clamscan with --debug --leave-temps. Example output on FSG compressed file: LibClamAV debug: UPX/FSG: empty section found - assuming compression LibClamAV debug: FSG: found old EP @1554 LibClamAV debug: FSG: Successfully decompressed LibClamAV debug: UPX/FSG: Decompressed data saved in /tmp/clamav-4eba73ff4050a26 and then create a signature for /tmp/clamav-4eba73ff4050a26 ========== And yes, I did try: clamscan --debug --leave-temps -d /var/tmp/rsync/MSRBL-Images.hdb - < /dev/null and still no temp file left. Bill _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
