<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2657.73">
<TITLE>RE: weird ClamAv error</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I increased it to 50 and still got this error, maybe I'll try 70.</FONT>
</P>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: MailScanner mailing list [<A HREF="mailto:MAILSCANNER@JISCMAIL.AC.UK">mailto:MAILSCANNER@JISCMAIL.AC.UK</A>]On</FONT>
<BR><FONT SIZE=2>Behalf Of Kevin Spicer</FONT>
<BR><FONT SIZE=2>Sent: Friday, December 05, 2003 4:28 PM</FONT>
<BR><FONT SIZE=2>To: MAILSCANNER@JISCMAIL.AC.UK</FONT>
<BR><FONT SIZE=2>Subject: Re: weird ClamAv error</FONT>
</P>
<BR>
<P><FONT SIZE=2>On Fri, 2003-12-05 at 21:17, Michele Neylon :: Blacknight Solutions</FONT>
<BR><FONT SIZE=2>wrote:</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>> It was a valid zip file of a text document. The total size of the file was</FONT>
<BR><FONT SIZE=2>> less than 1kb, so our sysadmin is rather confused - especially as the file</FONT>
<BR><FONT SIZE=2>> was clean</FONT>
</P>
<P><FONT SIZE=2>There are thresholds for both total size of zip and compression ratio.</FONT>
<BR><FONT SIZE=2>The default max compression ratio is currently 20:1 This is rather low</FONT>
<BR><FONT SIZE=2>actually. If you built clam from source you can tweak this...</FONT>
</P>
<P><FONT SIZE=2>Direct quote from the clam list...</FONT>
</P>
<P><FONT SIZE=2>Please edit libclamav/scanners.c, the line 64:</FONT>
</P>
<P><FONT SIZE=2>#define ZIPOSDET 20 /* FIXME: Make it user definable */</FONT>
</P>
<P><FONT SIZE=2>and increase the value to 50.</FONT>
</P>
<BR>
<P><FONT SIZE=2>[others have since suggested this should be 70 or higher]</FONT>
</P>
</BODY>
</HTML>