> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Friday, June 10, 2005 4:21 PM > To: ClamAV users ML > Subject: Re: [Clamav-users] odd problem w/clamd > > > and what of a virus zipped into a larger zip file? Since the largest > message we'll accept is 100M, then that's what my StreamMaxLength is > set at, per the comments in clamd.conf. on the other hand, it would > take an awfully determined virus distributed to put their virus in > such a large message..... >
I guess that if you check a 100MB email message which contains MIME/archives that have to be converted and unpacked several times there could be a disk bottle neck. Maybe your are suffering from I/O wait and it fixes when you kill the thread that's analizing that big email. What it's been said is that a selfreplicating email virus generally comes in a small email, because a 20MB virus would not fit anywhere =P. Setting StreamMaxLength to 1MB or 2MB wont let pass any of these. -Samuel _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
