On Wednesday 16 February 2005 14:50, Ted Fines shaped the electrons to say:Would you please send me this attachment off-list.
Please zip it and password protect it (password='password') so it comes through.
Thanks, Ted
Hope this works. -- Scott Ryan Telkom Internet
Holy bananas. This problem could easily hang any server using Clam 0.83. I asked Scott to send me the email in question and I see exactly the same behavior with Clam 0.83 on FreeBSD 5.3 / Dual Xeon 2.xx GHz machine:
qmail2# ls -l
total 816
-rw-r--r-- 1 root daemon 817795 Feb 16 14:47 1108491486.1513-1.ophelia.telkomsa.net
qmail2# time clamdscan 1108491486.1513-1.ophelia.telkomsa.net
/usr/home/ftp/incoming/1108491486.1513-1.ophelia.telkomsa.net: OK
----------- SCAN SUMMARY ----------- Infected files: 0 Time: 253.436 sec (4 m 13 s) 0.006u 0.000s 4:13.44 0.0% 0+0k 0+0io 0pf+0w
FOUR MINUTES, 13 SECONDS for an 800k email.
By comparison, I scanned a large (160 MB) .zip file:
qmail2# ls -al total 158260 drwx-wx-wx 2 root daemon 512 Feb 16 08:02 . drwxr-xr-x 3 root daemon 512 Feb 16 08:02 .. -rw-r--r-- 1 root daemon 161946301 Jan 18 16:01 GhostFull1117.zip qmail2# time clamdscan GhostFull1117.zip /usr/home/ftp/incoming/GhostFull1117.zip: OK
----------- SCAN SUMMARY ----------- Infected files: 0 Time: 86.319 sec (1 m 26 s) 0.006u 0.000s 1:26.32 0.0% 0+0k 0+0io 0pf+0w
A minute, 26 seconds.
...And a more realistic sized .zip file: qmail2# ls -l total 1104 -rw-r--r-- 1 root daemon 1098702 Feb 16 08:04 Archive.zip qmail2# time clamdscan . /usr/home/ftp/incoming/.: OK
----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.795 sec (0 m 0 s) 0.006u 0.000s 0:00.80 0.0% 0+0k 0+0io 0pf+0w
_______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
