Stephen Gran said: > On Tue, May 17, 2005 at 07:45:27PM -0700, Jef Poskanzer said: >> >> Hmm, ScanArchive is not set. It's commented out in both my >> clamd.conf >> >> and in clamd.conf.default. Should I try uncommenting it? >> > >> >Well, there is your problem, presumably. >> >> Good guess, but after uncommenting ScanArchive and restarting >> everything, >> I am still getting false positives. I captured another one and saved it >> to http://www.acme.com/jef/tmp/cl/ This time the log entries start >> around >> line 4164. Can you verify that it is looking inside the ZIP file >> this time? > > It certainly doesn't appear to. I am not sure why, though. Attached is > a diff of the outputs of your run and a run here of clamscan (0.85, > though). Maybe somebody else can spot the problem. > -- >
Looks like the missing entry is "Recognized Zip..." for the particular virus. Wonder what magic number it's looking for in the zip to make that determination. It isn't a universal problem as it did recognize another zip file. dp _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
