>> Hmm, ScanArchive is not set. It's commented out in both my clamd.conf >> and in clamd.conf.default. Should I try uncommenting it? > >Well, there is your problem, presumably.
Good guess, but after uncommenting ScanArchive and restarting everything, I am still getting false positives. I captured another one and saved it to http://www.acme.com/jef/tmp/cl/ This time the log entries start around line 4164. Can you verify that it is looking inside the ZIP file this time? --- Jef Jef Poskanzer [EMAIL PROTECTED] http://www.acme.com/jef/ _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
