I received an email today with a 14MB attachment which takes over two minutes to scan. The other scanners I have here take less than 5 seconds so I wondered if this is a problem with Clam ? Unfortunately I can't send the file to anyone due to its content, but if there's anything I can do to help debug this let me know!
Here's the output from a clamscan: buckk% (753) ptime clamscan --debug neoforums.mdb | tee debug.out LibClamAV debug: Loading databases from /opt/clamav/share/clamav LibClamAV debug: Loading /opt/clamav/share/clamav/daily.cvd LibClamAV debug: in cli_cvdload() LibClamAV debug: MD5(.tar.gz) = 37866f612124c2d3a9657ed88875d918 LibClamAV debug: Decoded signature: 37866f612124c2d3a9657ed88875d918 LibClamAV debug: Digital signature is correct. LibClamAV debug: in cli_untgz() LibClamAV debug: Unpacking /var/tmp//clamav-aac1d24221d265f9/COPYING LibClamAV debug: Unpacking /var/tmp//clamav-aac1d24221d265f9/viruses.db2 LibClamAV debug: Loading databases from /var/tmp//clamav-aac1d24221d265f9 LibClamAV debug: Loading /var/tmp//clamav-aac1d24221d265f9/viruses.db2 LibClamAV debug: Initializing main node LibClamAV debug: Initializing trie LibClamAV debug: Initializing BM tables LibClamAV debug: in cli_bm_init() LibClamAV debug: Loading /opt/clamav/share/clamav/main.cvd LibClamAV debug: in cli_cvdload() LibClamAV debug: MD5(.tar.gz) = 88a34570dc174c184b6a7c8350e24d4e LibClamAV debug: Decoded signature: 88a34570dc174c184b6a7c8350e24d4e LibClamAV debug: Digital signature is correct. LibClamAV debug: in cli_untgz() LibClamAV debug: Unpacking /var/tmp//clamav-e1b4a04aa12bfa00/COPYING LibClamAV debug: Unpacking /var/tmp//clamav-e1b4a04aa12bfa00/viruses.db LibClamAV debug: Loading databases from /var/tmp//clamav-e1b4a04aa12bfa00 LibClamAV debug: Loading /var/tmp//clamav-e1b4a04aa12bfa00/viruses.db LibClamAV debug: Ignoring signature for TR.DiskEraser.9 (too short) LibClamAV debug: Ignoring signature for Trojan.KillCMOS.7 (too short) LibClamAV debug: Ignoring signature for Trojan.STDOUT.6 (too short) LibClamAV debug: Ignoring signature for Trojan.STDOUT.7 (too short) LibClamAV debug: Ignoring signature for W32.XTC (too short) LibClamAV debug: Loading /opt/clamav/share/clamav/localsigs.db LibClamAV debug: Matched signature for file type: HTML data LibClamAV debug: Matched signature for file type: HTML data LibClamAV debug: Matched signature for file type: HTML data ... repeated some 100 times ... LibClamAV debug: Matched signature for file type: HTML data LibClamAV debug: in cli_scanhtml() neoforums.mdb: OK ----------- SCAN SUMMARY ----------- Known viruses: 23061 Scanned directories: 0 Scanned files: 1 Infected files: 0 Data scanned: 14.44 MB I/O buffer size: 131072 bytes Time: 116.610 sec (1 m 56 s) real 1:56.640 user 1:52.522 sys 0.484 ------------------------------------------------------- This SF.Net email is sponsored by OSTG. Have you noticed the changes on Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now, one more big change to announce. We are now OSTG- Open Source Technology Group. Come see the changes on the new OSTG site. www.ostg.com _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
