Oversized zip?

[Michele]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:

> Fractal IT Dept. wrote:
>
>> Hi everyone,
>>
>> One of our clients is complaining that when they zip documents and send
>> them through our server, the file never arrives. After doing some
>> investigation on my end, I see that the file is quarantined with a
>> message saying "Report v11.zip contains Oversized Zip" and has been
>> identified as "infected". According to the company, it looks like the
>> file is just a quark document that has been zipped, so it's unlikely
>> it's actually infected with anything.
>
>
> Are you using Clam? Most virus scanners protect themselves from the "zip
> of death", an archive that unpacks to a huge size. Clam calls it
> Oversized.Zip but it's not actually a virus but a DOS attempt.
>
> Some clean files can trigger this, like BMP image files compress very
> well and it's usually the compression ratio that is used to determine
> this.
>
Which version of clam? If I remember correctly this was an issue with
some of the older versions of clam

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!