Problems with clamavmodule

[Alvaro Marin]

Hi,

I'm using version 4.49.7 of MailScanner and I trying to use Clamavmodule
to scan messages for virus.

Here the configuration:

Virus Scanners = clamavmodule
ClamAVmodule Maximum Recursion Level = 8
ClamAVmodule Maximum Files = 1000
ClamAVmodule Maximum File Size = 10000000
ClamAVmodule Maximum Compression Ratio = 250

Some attachments are scanned and detected fine :

Jan  6 16:30:16 linux01 MailScanner[8985]: ClamAVModule::INFECTED::
Worm.SomeFool.P:: ./1EutXc-0005QP-F0/message.scr 

but other ones:

Jan  6 13:02:38 linux01 MailScanner[19498]: ClamAVModule::ERROR:: File
size limit exceeded.:: ./1EuqIj-0005Gm-Fs/downloadm.zip 

where downloadm.zip is a 55ks file (sober.U-3) sent by me:

-rw-r--r--  1 split users 55K ene  6 11:56 downloadm.zip

In other servers with same MS configuration (different SO) this virus is
detected.

Here MailScanner -v output:

This is Red Hat Linux release 7.3 (Valhalla)
This is Perl version 5.008007 (5.8.7)

This is MailScanner version 4.49.7
Module versions are:
1.00    AnyDBM_File
1.16    Archive::Zip
1.04    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.73    File::Basename
2.08    File::Copy
2.01    FileHandle
1.07    File::Path
0.16    File::Temp
1.32    HTML::Entities
3.48    HTML::Parser
2.35    HTML::TokeParser
1.21    IO
1.11    IO::File
1.123   IO::Pipe
1.50    Mail::Header
3.07    MIME::Base64
5.418   MIME::Decoder
5.418   MIME::Decoder::UU
5.418   MIME::Head
5.418   MIME::Parser
3.07    MIME::QuotedPrint
5.418   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.06    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
0.17    Convert::TNEF
1.814   DB_File
1.10    Digest
1.01    Digest::HMAC
2.36    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.17    Mail::ClamAV
3.001000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.18    Net::CIDR::Lite
0.55    Net::DNS
0.33    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.4     Sys::Hostname::Long
2.48    Test::Harness
0.54    Test::Simple
1.95    Text::Balanced
1.35    URI


Any ideas?
Thx :)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!