On Fri, 04 Jan 2008 17:41:34 +0200 =?ISO-8859-1?Q?T=F6r=F6k_Edwin?= <[EMAIL PROTECTED]> wrote:
> Phil Chambers wrote: > > clamdscan > > > > ----------- SCAN SUMMARY ----------- > > Infected files: 0 > > Time: 0.002 sec (0 m 0 s) > > > > So, clamscan detects the signature but clamdscan does not! Note that some > > examples of this signature do get detected by clamd.) > > > > > > Clamdscan detects the message here (if I put that signature in a ndb > file, and tell clamd to load that). > Check that clamscan and clamdscan use same databases (and post output of > clamconf). > Also check that clamd is able to read the file, try sending it an EICAR, > or some of the files in the test/ directory. > > Best regards, > --Edwin Note that the clamd logs show that this signature is being detected in some messages, so the signature is in clamd's database. I put the clam.exe test file in the same directory as my problem spool file and set its permissions and clamdscan found it. The non-blank, non-comment lines from my clam.conf are: LogFile /var/log/clamd.log LogFileMaxSize 20M LogTime yes LocalSocket /tmp/clamd FixStaleSocket yes TCPAddr 127.0.0.1 MaxThreads 80 User exim ArchiveMaxCompressionRatio 500 ArchiveBlockEncrypted yes Phil. --------------------------------------- Phil Chambers ([EMAIL PROTECTED]) University of Exeter _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
