On Dec 21, 2007 3:25 AM, j t <[EMAIL PROTECTED]> wrote: > Hi all. > > I'm trying to track down a performance issue that I get using clamwin, > and I've traced the problem back to clamav (I've tested clamav's > current subversion on my Debian Etch box). > > On my Thinkpad T60, I can run clamscan against a 24 megabyte binary > (filled with random bytes) in about 10 seconds. When I run clamscan > against my 24 megabyte ole2 document, it takes 675 seconds, which > works out at over 67 times as long to process a similar sized file. > > I fully realize that there is additional overhead in scanning compound > documents, but a 6600% increase seems rather excessive. Is my best bet > to log this as a bug, or am I missing something obvious here? > > In case anyone else would like to repeat my experiment, the files are here: > > http://www.sourceworks.co.uk/public/clamav/bigRandomBinary > http://www.sourceworks.co.uk/public/clamav/QuickTime.msi > > Thanks in advance for any help you can offer.
This is an old bug that never seems to get fixed. I've had so much issues with mostly PowerPoint documents I've had to disable OLE scanning. It was hard to get the maintainers to see it as a flaw, they reacted more like "it's an archive so it takes more time". :-) -- /peter _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
