Cormack, Ken wrote:
If an ext2 fs is converted to an ext3 while it is mounted the .journal
inode cannot be properly hidden. This actually goes for any mounted
ext2 fs, but the ext3 driver will hide the inode on next mount. The
problem comes up with the / mount point because it is mounted read only
at boot, and thus is just remounted rw. So the driver has no chance to
hide the inode.
One way to fix this is to boot from a CD image and then mount straight
out the ext3 file system under the root provided on the boot CD.
Chris,
You are correct about a converted, but not yet remounted filesystem. I was
basing my response on an assumption that the system had been originally
created with EXT3 (not upgraded from EXT2), and/or that the system had been
rebooted at least once since the journalling was installed. Your "converted
but not yet remounted" scenario was one I hadnt considered.
May be the mount is not so correct, from an earlier ext2. But why
the virus was found? ist it a false positive.
An online virus scan is not possible with this server.
thanks. Bye Fred
--
Software Development EsPresto AG
-----------------------------------------------------------------
[EMAIL PROTECTED] Breite Str. 30-31
Tel/Fax: +49.30.90 226.750/.760 10178 Berlin/Germany
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
