On Mon, Nov 03, 2003 at 03:20:40PM +0100, Tomasz Kojm wrote: > --=.z+M1SVP9OtMwm: > Content-Type: text/plain; charset=US-ASCII > Content-Transfer-Encoding: 7bit > > On Mon, 3 Nov 2003 12:51:28 +0100 > David Jansen <[EMAIL PROTECTED]> wrote: > > > I am running ClamAV and McAfee from MailScanner and lately I noticed > > that McAfee seems to intercept quite a number of viruses that ClamAV > > didn't detect. Freshclam has run, virus definitions seem to be > > up-to-date. Further investigation turns out that it is always the > > Mimail.c virus: > > We detect all current Mimail variants. Something must be wrong with your > clamav installation. You may submit the sample for analysis at out site.
No need: bash-2.05# clamscan /var/spool/MailScanner/quarantine/20031103/hA3ABmS12759/photos.zip /var/spool/MailScanner/quarantine/20031103/hA3ABmS12759/photos.zip: File size limit exceeded. /var/spool/MailScanner/quarantine/20031103/hA3ABmS12759/photos.zip: Worm.Mimail.C FOUND So, the virus is found, but another message is produced about a file size limit. Then from MailScanners log: Nov 3 11:12:02 maas MailScanner[6304]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/6304/./hA3ABmS12759/photos.zip: File size limit exceeded.". Please contact the authors! Nov 3 11:12:02 maas MailScanner[6304]: (raw) /var/spool/MailScanner/incoming/6304/./hA3ABmS12759/photos.zip: Worm.Mimail.C FOUND But the unrecognized line of output makes MailScanner ignore ClamAV's result. Now the problem: what limit is this refering to, and how should it be changed? Both StreamMaxLength and ArchiveMaxFileSize are set to 10M, much bigger than the infected file (which is only 12958 bytes). I'm running ClamAV 20030829. Will upgrading to the latest snapshot solve this problem? David Jansen ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
