ClamAV 0.60 problems - ProcessClamAVOutput: un recognized line

[Desai, Jason]

Thanks for the response.  I'm running Debian.  Unzip version 5.50-1woody1.

But I'm pretty sure this is a ClamAV issue, since the man page talks about
the options I put in clamav-wrapper.  And since those changes, I've not seen
the error any more.

I also saved out the offending file and ran clamav-wrapper on it both with
and without my ScanOptions.  Without them, I get the output that MailScanner
does not recognize.  And I think that it does not completely scan the file.
With them, it scans the file fine.

Jason

> 
> I don't use CLAM-AV, but IIRC, it uses the external unzip 
> utility for .zip 
> files and maybe you two are using different versions (and 
> they yeld different 
> output)...
> 
> what does
> rpm -q unzip
> yeld?
> 
> If the output changed, I guess you'll have to wait for Julian 
> to return... 
> unless someone is able to come up with a patch before...
> 
> El 22 Jul 2003 a las 17:46, Miguel Koren O'Brien de Lacy escribió:
> 
> > Jason;
> > 
> > I have these versions on 2 servers (RH7.3) with the default 
> values and
> > it works fine form me.
> > 
> > Miguel
> > 
> > Desai, Jason wrote:
> > 
> > >Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV 
> to 0.60.  I've
> > >noticed a few entries in my mail.log file such as:
> > >
> > >Jul 21 15:06:47 hostname MailScanner[26628]:
> > 
> >/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 
> Rev 14.zip:
> > >Files number limit exceeded.
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line
> > 
> >"/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3
>  Rev 14.zip:
> > >Files number limit exceeded.". Please contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Load/LoadAsm.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Load/LoadAsm.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Main/MainCc.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Main/MainCc.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Main/MainMap.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Main/MainMap.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/RDISTART/RdiAsm.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> > >CODE/RStatusDecodeDLL/TestDriver/test.bcv
> > >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RStatusDecodeDLL/TestDriver/test.bcv ".
> > >Please contact the authors!
> > >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> > >CODE/SensorDataDLL/res/SensorDataDLL.rc2
> > >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/SensorDataDLL/res/SensorDataDLL.rc2 ".
> > >Please contact the authors!
> > >
> > >and
> > >
> > >Jul 21 19:28:28 hostname MailScanner[25439]:
> > 
> >/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_
> 07_18.zip: File
> > >size limit exceeded.
> > >Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
> > >unrecognised line
> > 
> >"/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT
> _07_18.zip:
> > >File size limit exceeded.". Please contact the authors!
> > >
> > >I am thinking that this has to do with the new version of 
> ClamAV.  I found
> > >some options for clamscan to disable some of these limits, 
> and put them in
> > >clamav-wrapper.  Specifically, I set
> > >
> > >ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"
> > >
> > >Questions:
> > >
> > >*  Has anyone else come across this?
> > >*  Since MailScanner already has timeouts for virus 
> scanning, would you
> > >think it is safe to run this way?
> > >*  If yes, should this be the default?  (I'm not sure if 
> versions < 0.60
> > >support this - maybe put some comments in the 
> clamav-wrapper script?)
> > >*  Is "unrecognised" British for "unrecognized" or is it 
> just misspelled?
> > >
> > >Thanks.
> > >
> > >Jason
> > >
> > >
> 
> 
> --
> Mariano Absatz
> El Baby
> ----------------------------------------------------------
> The best cure for insomnia is to get a lot of sleep.
>       -- W.C. Fields
>