Data from one that doesn't work:
Definitions are current:
mail joe $ freshclam
ClamAV update process started at Wed May 4 08:27:53 2005
main.cvd is up to date (version: 31, sigs: 33079, f-level: 4, builder: tkojm)
daily.cvd is up to date (version: 866, sigs: 1070, f-level: 4, builder: arnaud)
ClamAV is current: mail joe $ clamscan -V ClamAV 0.84/858/Thu Apr 28 09:02:38 2005
The file IS identified on-line: http://test-clamav.power-netz.de Properly identifies the virus Clamav-Output:
/tmp/phpULWCor: Worm.Sober.P FOUND
And found something: Worm.Sober.P
Yet clamscan does not: mail joe $ clamscan account_info-text.zip account_info-text.zip: OK
Nor does clamdscan: mail joe $ clamdscan account_info-text.zip /usr/home/joe/account_info-text.zip: OK
----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.080 sec (0 m 0 s)
----------- SCAN SUMMARY ----------- Known viruses: 33876 Engine version: 0.84 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.28 MB Time: 0.595 sec (0 m 0 s)
And it is not caught when unzipped: mail joe $ clamscan Winzipped-Text_Data-1.txt\ \ \ \ \ \ \ \ \ \ \ .pif Winzipped-Text_Data-1.txt .pif: OK
----------- SCAN SUMMARY ----------- Known viruses: 33876 Engine version: 0.84 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 0.23 MB Time: 0.574 sec (0 m 0 s)
On May 4, 2005, at 6:01 AM, Alvaro Urķa wrote:
Hi again,
On Wed, 04 May 2005 14:17:32 +0400 George Chelidze <[EMAIL PROTECTED]> wrote:
Hello,
You can use online scanner at http://test-clamav.power-netz.de to scan this files in question. Worm.Sober.P is found in provided example.
I didn't know that site. Thank you very much. And BTW, i've just upgraded
to 0.84 and ClamAV detects it now ;-)
Regards, Alvaro Urķa _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
_______________________________________________ http://lurker.clamav.net/list/clamav-users.html
