Is it possible to

[Philip Parsons]

Thanks for this. The question has been asked on the other lists multiple times they point out that the log entries states "MailScanner has detected a possible denial of service attack."  So they say it is a MailScanner problem.  I know have 3 customers with the same problem. Have not remove all the extra databases yet getting to that today. 

Techeez on the go so please excuse the spelling.

> On Sep 2, 2016, at 12:28 AM, Steve Basford <steveb_clamav at sanesecurity.com> wrote:
> 
> 
>> On Fri, September 2, 2016 2:06 am, Philip Parsons wrote:
>> I believe I am using all of them.  I have removed some and tried that but
>> I think I it is a good Idea to remove then all I will try it with nothing
>> just clamav databases.  The funny thing is I now have a second system
>> different customer that is also having the same issue.  This is all
>> related to these .zip files
> 
> Note: might be an idea to move this off-list or to clamav-users or to
> sanesecurity list but for now....
> 
> This is a slightly unfair test but I scanned a small file with each
> database and all returned an OK but here are the timings for each database...
> 
> If you are using any of the ones marked [Possible Performance Issue]
> then removed them first and see what happens.
> 
> Securiteinfo:
> 
> spam_marketing.ndb                 230250 ms [Possible Performance Issue]
> javascript.ndb                     23109 ms [Possible Performance Issue]
> securiteinfo.hdb                   11781 ms [Possible Performance Issue]
> securiteinfoascii.hdb              1532 ms
> securiteinfohtml.hdb               1469 ms
> 
> Sanesecurity mirrored:
> 
> scamnailer.ndb                     8547 ms
> phish.ndb                          4750 ms
> junk.ndb                           2391 ms
> spear.ndb                          1985 ms
> phishtank.ndb                      1844 ms
> scam.ndb                           1641 ms
> badmacro.ndb                       1500 ms
> winnow_phish_complete.ndb          1484 ms
> winnow_phish_complete_url.ndb      1484 ms
> jurlbl.ndb                         1391 ms
> winnow_malware_links.ndb           1344 ms
> jurlbla.ndb                        1313 ms
> blurl.ndb                          1313 ms
> porcupine.ndb                      1296 ms
> foxhole_filename.cdb               1282 ms
> bofhland_malware_attach.hdb        1266 ms
> foxhole_all.cdb                    1266 ms
> foxhole_generic.cdb                1266 ms
> lott.ndb                           1266 ms
> winnow_extended_malware.hdb        1266 ms
> winnow_malware.hdb                 1266 ms
> winnow_spam_complete.ndb           1266 ms
> bofhland_phishing_URL.ndb          1265 ms
> bofhland_cracked_URL.ndb           1250 ms
> bofhland_malware_URL.ndb           1250 ms
> crdfam.clamav.hdb                  1250 ms
> doppelstern.ndb                    1250 ms
> doppelstern-phishtank.ndb          1250 ms
> rogue.hdb                          1250 ms
> spam.ldb                           1250 ms
> spamattach.hdb                     1250 ms
> spamimg.hdb                        1250 ms
> spearl.ndb                         1250 ms
> winnow.attachments.hdb             1250 ms
> winnow_bad_cw.hdb                  1250 ms
> winnow.complex.patterns.ldb        1235 ms
> doppelstern.hdb                    1234 ms
> foxhole_js.cdb                     1234 ms
> winnow_extended_malware_links.ndb  1234 ms
> 
> Cheers,
> 
> Steve
> Web : sanesecurity.com
> Blog: sanesecurity.blogspot.com
> Twitter: @sanesecurity
> 
> 
> 
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/listinfo/mailscanner
> 
> 
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>