> > After I updated clamd to the latest version (0.71) it > stopped detecting (and avoiding) mailbombs. > > (i used the test mail-bomb from amavisd-new) > > Has anyone noticed this problem? > > > > I use RH9 with amavisd-new. clam was installed from a compiled RPM. > > Please try the latest version (from CVS) and see if it has > been fixed there.
Tested with clamav-devel-20040524 and the problem remains. There is no specific info in clamd.log, and when I run the server in debug mode I see lots of output from the mailbomb. --------------------------- Tue May 25 11:39:31 2004 -> +++ Started at Tue May 25 11:39:31 2004 Tue May 25 11:39:31 2004 -> Log file size limit disabled. Tue May 25 11:39:31 2004 -> Verbose logging activated. Tue May 25 11:39:31 2004 -> Running as user amavis (UID 103, GID 105) Tue May 25 11:39:31 2004 -> Reading databases from /var/lib/clamav Tue May 25 11:39:32 2004 -> Protecting against 21694 viruses. Tue May 25 11:39:32 2004 -> Unix socket file /var/run/clamav/clamd.sock Tue May 25 11:39:32 2004 -> Setting connection queue length to 30 Tue May 25 11:39:32 2004 -> Listening daemon: PID: 3461 Tue May 25 11:39:32 2004 -> Archive: Archived file size limit set to 10485760 bytes. Tue May 25 11:39:32 2004 -> Archive: Recursion level limit set to 5. Tue May 25 11:39:32 2004 -> Archive: Files limit set to 1000. Tue May 25 11:39:32 2004 -> Archive: Compression ratio limit set to 200. Tue May 25 11:39:32 2004 -> Archive support enabled. Tue May 25 11:39:32 2004 -> RAR support enabled. Tue May 25 11:39:32 2004 -> Blocking encrypted archives. Tue May 25 11:39:32 2004 -> Mail files support enabled. Tue May 25 11:39:32 2004 -> OLE2 support enabled. Tue May 25 11:39:32 2004 -> Self checking every 3600 seconds. Tue May 25 11:51:38 2004 -> Shutting down the main socket. Tue May 25 11:51:38 2004 -> Closing the main socket. Tue May 25 11:51:38 2004 -> Socket file removed. Tue May 25 11:51:38 2004 -> Pid file removed. Tue May 25 11:51:38 2004 -> Exiting (clean) Tue May 25 11:51:38 2004 -> --- Stopped at Tue May 25 11:51:38 2004 --------------------------- Joao Frade ------------------------------------------------------- This SF.Net email is sponsored by: Oracle 10g Get certified on the hottest thing ever to hit the market... Oracle 10g. Take an Oracle 10g class now, and we'll give you the exam FREE. http://ads.osdn.com/?ad_id149&alloc_id66&op=click _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
