weird ClamAv error

[Kevin Spicer]

On Fri, 2003-12-05 at 21:17, Michele Neylon :: Blacknight Solutions
wrote:
>
> It was a valid zip file of a text document. The total size of the file was
> less than 1kb, so our sysadmin is rather confused - especially as the file
> was clean

There are thresholds for both total size of zip and compression ratio.
The default max compression ratio is currently 20:1  This is rather low
actually.  If you built clam from source you can tweak this...

Direct quote from the clam list...

Please edit libclamav/scanners.c, the line 64:

#define ZIPOSDET 20 /* FIXME: Make it user definable */

and increase the value to 50.


[others have since suggested this should be 70 or higher]