Still getting false oversized ZIP

[Remco Barendse]

On Tue, 24 Jul 2007, Glenn Steen wrote:

> On 24/07/07, Remco Barendse <mailscanner at barendse.to> wrote:
>>  Hi list!
>>
>>  I am still getting message that zip files sent are oversized and therefore
>>  blocked, if i remember correctly it was due to clam giving false
>>  positives.
>>
>>  I will google for the solution, but maybe in the meantime it would be nice
>>  to disable the feature of scanning for oversized zip files by default in
>>  MailScanner?
>
> Not really, this is solely a clamav problem, AFAICS.

Yes i am aware of that :)  But still i think that in that case the 
parameters MS is giving to clam should in this case be default to not 
check for 'oversized' zip files. :)

> Did you upgrade clam resently? Perhaps skipping a few version? What
> version _do_ you use? Do you use ClamAVModule? Did you relink it
> (perhaps by "force") after the (possible) clamav upgrade? Did tyou
> adjust the max compression ratio setting (upwards) in
> MailScanner.conf?

I update clam regularly, am now at the latest version 91.1 and it still 
gives me false positives. I already increased max compression rate by 10 
times.

> So many questions...:-)
> BTW, one more... Aren't you on Solaris or something? My memory isn't
> that good, perhaps you should tell more about your setup:-).

No, just plain old CentOS 3.x and 4.x boxes :)  But the problem really is 
with clam.