Since upgrading to 0.96.5 I've seen different results with the SCAN
command..
In my initial testing I did not see this behavior, however it has been
occurring off and on this morning.
Not in every instance of the results returned by the SCAN command, but
some will include the md5sum and size of the file being scanned in the
results.
# clamdscan -V
ClamAV 0.96.5/12346/Wed Dec 1 10:16:47 2010
"Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND"
But on other scans it returns just the signature name:
"Eicar-Test-Signature FOUND"
I have not seen this behavior with the 0.96.4 version, only sporadically
since the upgrade on a test machine to 0.96.5.
The command passed to the socket is "SCAN /path/to/file"
The file itself is populated with the eicar test string prior to the
SCAN command being given.
I did not see anything in the clamdoc related to the output of the MD5
and file size, nor did I see anything mentioned in the changelog.
Have I overlooked info in any other docs? Is this expected behavior and
if so what determines when the md5 and the file size will be included in
the SCAN results?
Thanks,
Clay
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
