On Mon, 3 Nov 2003, Tomasz Kojm wrote:
> On Mon, 3 Nov 2003 16:54:56 +0000
> Antony Stone <[EMAIL PROTECTED]> wrote:
>
> > I've had a look at this sample and ClamAV is indeed detecting that the
> > zip file contains Worm.Mimail.C, however clamscan also reports "File
> > size limit exceeded", which confuses MailScanner and results in no
> > virus being reported by that application.
>
> That may be also considered as a bug in MailScanner.
>
> Best regards,
> Tomasz Kojm
We see a similar problem with clamd (20030317). We run sendmail +
MIMEDefang/SA + clamd to scan all incoming emails at UD.
clamscan detects the "broken on purpose" ZIP files and reports an error
message (correctly), when you scan the ZIP file directly or when you scan
the directory containing the broken ZIP file. clamd, however, ignores all
errors while scanning a directory hierarchy, so in the case where it's
scanning a directory that contains only the broken ZIP file, you get an OK
message from clamd (very broken behavior IMO!). We've been hacking at the
clamd code to report the "ERROR" messages for any and every file that does
not scan correctly, and we have changed MIMEDefang to detect these "ERROR"
messages from clamd and treat them the same way we do for "FOUND" messages
(treat the message as having a virus and drop it). This is somewhat
"strong" treatment... but it's better than increasing the
"ArchiveMaxFileSize" setting or disabling the size check.
Yes, I know 20030317 is very old, but it has stayed running since the time
we installed it, and the more current snapshots of clamd crash pretty
quickly for us. And, it appears clamd still works the same way in the
above regards. We need clamd to stay running and work correctly in our
environment where we process 100000-500000 email messages per day with
it...
Ed
Ed Phillips <[EMAIL PROTECTED]> University of Delaware (302) 831-6082
Systems Programmer III, Network and Systems Services
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
