You may also use the clamd “AlertExceedsMax” option to have it alert with the 
heuristic signature name “Heuristics.Limits.Exceeded”.
If you do this, you will probably observe other files that also exceed the 
maximums but don’t issue a warning-level message when they do so. Honestly, I’m 
not sure why the Xz scanner prints a warning message for this situation.  It is 
unusual.
-Micah

From: clamav-users <clamav-users-boun...@lists.clamav.net> on behalf of Al 
Varnell via clamav-users <clamav-users@lists.clamav.net>
Reply-To: ClamAV users ML <clamav-users@lists.clamav.net>
Date: Monday, August 19, 2019 at 9:03 PM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Al Varnell <alvarn...@mac.com>
Subject: Re: [clamav-users] decompress file size exceeds limits

Correction. Apparently clamdscan doesn't have a debug mode, but -v for verbose 
might help.

Best to use clamscan --debug.

-Al-
================
Run clamscan or clamdscan --debug. The log should be able to tell you what and 
where that file is.

-Al-

On Mon, Aug 19, 2019 at 02:43 PM, Michael Newman via clamav-users wrote:
I keep getting this message:

"LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only 
scanning 27262976 bytes"

I know what it means. Is there some way to find that file?

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Reply via email to