Kate Kleinschafer wrote: > Is there a way I can tell if its still running as clamav? I think it was > doing this before I changed it to clamd today. Look at the clamd log, you won't find the user but the last "LOCAL: Unix socket file /tmp/clamd.socket" should tell you if its using the right socket name or not. -- René Berber