Re: [clamav-users] Scanning very large files in chunks

2016-08-12 Thread sapientdust+clamav
On Fri, Aug 12, 2016 at 2:51 PM, TR Shaw wrote: > Actually there is always a probability that a detection will not occur if you > beak apart at file into pieces This is due to the following > > 1) md5 signatures based upon any file type are applied on any file and match > to the md4 hash of tha

Re: [clamav-users] Scanning very large files in chunks

2016-08-12 Thread TR Shaw
Actually there is always a probability that a detection will not occur if you beak apart at file into pieces This is due to the following 1) md5 signatures based upon any file type are applied on any file and match to the md4 hash of that file AND the file’s size. If you break apart a file, ne

Re: [clamav-users] Scanning very large files in chunks

2016-08-12 Thread sapientdust+clamav
On Thu, Aug 11, 2016 at 10:15 AM, G.W. Haywood wrote: > Hello once again, > > On Thu, 11 Aug 2016, sapientdust+cla...@gmail.com wrote: > >> I scan a 4.5 GB file in multiple instream calls, by scanning the first >> 3 GB in one call, and then making a second instream call that provides >> the first

Re: [clamav-users] Scanning very large files in chunks

2016-08-11 Thread Paul Kosinski
After posting a while ago about scanning (extremely) large disk images, I realized that files need not be contiguous in a disk image. It all depends on the block allocation algorithm of the file system and, in many cases, to fragmentation that occurs as the disk is used. So, even if you could scan

Re: [clamav-users] Scanning very large files in chunks

2016-08-11 Thread G.W. Haywood
Hello once again, On Thu, 11 Aug 2016, sapientdust+cla...@gmail.com wrote: I scan a 4.5 GB file in multiple instream calls, by scanning the first 3 GB in one call, and then making a second instream call that provides the first N MB followed by the last 2 GB of the file. Would clamav be expe

Re: [clamav-users] Scanning very large files in chunks

2016-08-10 Thread sapientdust+clamav
Hello, On Wed, Aug 10, 2016 at 10:11 AM, G.W. Haywood wrote: > Hello again, > > In August 2016, sapientdust+cla...@gmail.com wrote: > >> The specifics are not important to my question > > > That's not what you said earlier. To be specific, you said: > >> >> In my case, the consequence factor is

Re: [clamav-users] Scanning very large files in chunks

2016-08-10 Thread G.W. Haywood
Hello again, In August 2016, sapientdust+cla...@gmail.com wrote: The specifics are not important to my question That's not what you said earlier. To be specific, you said: >> In my case, the consequence factor is very large ... >> Does anybody have any feedback on the proposed solution

Re: [clamav-users] Scanning very large files in chunks

2016-08-09 Thread sapientdust+clamav
On Tue, Aug 9, 2016 at 9:40 AM, G.W. Haywood wrote: > Hi there, > > On Tue, 9 Aug 2016, sapientdust+cla...@gmail.com wrote: > On Thu, Aug 4, 2016 at 7:14 PM, Al Varnell wrote: > >>> ... Risk = threat x vulnerability x consequence >> >> >> I agree. In my case, the consequence factor is very large

Re: [clamav-users] Scanning very large files in chunks

2016-08-09 Thread Reindl Harald
Am 09.08.2016 um 18:40 schrieb G.W. Haywood: Does anybody have any feedback on the proposed solution to scanning large files in chunks? Stop worrying about it, it's a waste of time and effort. The probability that you will actually find what you're looking for is very small. ... are there

Re: [clamav-users] Scanning very large files in chunks

2016-08-09 Thread G.W. Haywood
Hi there, On Tue, 9 Aug 2016, sapientdust+cla...@gmail.com wrote: On Thu, Aug 4, 2016 at 7:14 PM, Al Varnell wrote: ... Risk = threat x vulnerability x consequence I agree. In my case, the consequence factor is very large ... Perhaps you can elucidate the consequences. If the consequence

Re: [clamav-users] Scanning very large files in chunks

2016-08-08 Thread sapientdust+clamav
On Thu, Aug 4, 2016 at 7:14 PM, Al Varnell wrote: > ... > With the ever increasing malware issues we face today, it’s important to > consider this: > > Risk = threat x vulnerability x consequence I agree. In my case, the consequence factor is very large, and I have to scan even the large files s

Re: [clamav-users] Scanning very large files in chunks

2016-08-04 Thread Al Varnell
Certainly agree that many, many disk images are known to contain malware, but the usual approach there is to use a hash value for the file as there are other issues with attempting to scan within the image without mounting it first. The most recent versions of ClamXav now does both a hash check

Re: [clamav-users] Scanning very large files in chunks

2016-08-04 Thread Paul Kosinski
Really large files like this would likely either be video files or disk images (incl. DVD and Blu-Ray). Both kinds could, in principle, have malware embedded. Disk images often contain whole file systems and thus many, many files. The alternative is to scan the entire FS after it is "mounted". (Of

Re: [clamav-users] Scanning very large files in chunks

2016-08-04 Thread Al Varnell
Does anybody have any evidence of malware that exceeds 4GB? Although I can certainly see the utility of the proposed capability as a hedge for the future, it would seem to be a waste of time and compute power to scan such large files today. With the ever increasing malware issues we face today,