Max file size

[Randal, Phil]

All of which is pretty pointless because a large file with the EICAR
string attached at the end is no longer the EICAR "virus", IMHO, as the
EICAR test file is defined to be 68 bytes long, no more, no less.

Cheers,

Phil

--
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf 
> Of Guy Story KC5GOI
> Sent: 04 January 2008 14:48
> To: MailScanner discussion
> Subject: Re: Max file size
> 
> Matt, I did add the EICAR at the end of my test text file.  Based on
> your suggestion I moved it to the top of the text file and that was
> stopped.  Putting the EICAR in the middle kept it from getting caught.
> I increased the Max SpamAssassin Size parameter from 30000 to 
> 300000 and
> that did not clear the error message.  I will keep looking.
> 
> Jeff mentioned looking for "Max Spam Check Size ="  I could not find
> that entry in my MailScanner.conf file.  That was also the parameter
> that my Google searches refered to.  If it is not present, is that the
> default setting?
> 
> Matt Kettler wrote:
> > Guy Story KC5GOI wrote:
> >> I have a max file size question. I am getting " is too big for spam
> >> checks (2090980 > 150000 bytes) " A search of 
> mailscanner.conf does not
> >> find the vaule 150000.
> > 
> > This should be the "Max SpamAssassin Size" option, which, 
> AFAIK, should
> > only apply to SpamAssassin, not AV scanning.
> > 
> >> I read a few posts I found after using google and
> >> they indicate this is not an issue. I added the EICAR to a 
> 175k text
> >> file. It was flagged as too big for spam scanning and the 
> AV scanning
> >> did not happen.
> > 
> > Are you sure your AV would detect the resulting file as a virus?
> > 
> > I tried pre-pending it to a 400k file, and MailScanner 
> found it just fine.
> > 
> > Appending it to the same file, it was not detected.
> > 
> > HOWEVER, copying this same file to my server and manually 
> running all of
> > AV scanners on it (bitdefender, clamav, command av) did not detect a
> > virus either. Apparently most AV products will only detect 
> eicar if it's
> > at the beginning of the file. (This is probably to reduce FP's)
> 
> 
> -- 
> Regards,
> 
> Guy Story KC5GOI
> MIS Manager Texas Hematology Oncology Centers P.A.
> 
> This email, facsimile, or letter and any files or attachments
> transmitted with it contains information that is confidential and
> privileged.  This information is intended only for the use of the
> individual(s) and the entity(ies) to whom it is addressed.  If you
> are the intended recipient, further disclosures are prohibited
> without proper authorization.  If you are not the intended recipient,
> any disclosure, copying, printing or use of this information is
> strictly prohibited and possibly a violation of federal or state
> law and regulations.  If you have received this information in
> error, please notify Patients Comprehensive Cancer Center at
> 972.395.1010 or via email at privacy at pccctx.com.  PCCC, its
> subsidiaries, and affiliates hereby claim all applicable privileges
> related to this information.
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> 
>