ClamAVModule Oversized.Zip

[Scott Silva]

Dan Farmer spake the following on 4/25/2007 1:47 PM:
> Hello all,
> 
> I've got an issue with Oversized.Zip infections that I'm trying to
> disable and can't seem to nail down the correct settings. I've been
> using clamav for our virus scanning for longer than I care to recall and
> just this morning switched the setting over to clamavmodule to reduce
> the load on our relay. It reduced the load and everything is working but
> we get a lot of zip files (artwork) that compress very well and they are
> getting detected as viruses (Oversized.Zip)
> 
> I've searched the Mailscanner list and the ClamAV list and tried the
> following:
> 
> /usr/local/etc/clamd.conf:
> ArchiveMaxCompressionRatio 0
> 
> /etc/MailScanner/Mailscanner.conf:
> ClamAVmodule Maximum Compression Ratio = 0
Try something like 900 or 1000. I don't think a "0" disables this setting.
> 
> installed versions (i know they're a bit behind):
> MailScanner-4.58.9-1
> install-Clam-0.88.7-SA-3.1.8
> 0.17    Mail::ClamAV
> 
> I reloaded MailScanner, start/stopped it, and finally rebooted the
> machine each time, to no avail. I created a 1MB file that zips to 4k and
> it gets detected everytime. Virus scanning doesn't get cached like SA
> results, so I figure I don't have to keep changing the file each test.
> 
> Is there a way to determine what config file clamavmodule is using
> and/or what current settings are? Where else should I be looking?
> 
> Thanks,
> Dan
> --MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!


-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!