-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Kaplan, Andrew H. wrote:
> I am running clamav 0.88.1 on an HP-UX 10.20 trusted workstation. I am > getting a > series of the following error messages in the mail.log file: > > Commercial Scanner ClamAV Timed Out! > Virus Scanning: Denial of Service attack detected! That's from MailScanner, indirectly from clamav. > This appears to be affecting only one user. However, that user is getting > virus > warnings on virtually all his incoming mail. I am guessing the user's mailbox > is somehow corrupted and the > vast majority of these messages are false positives that are attributed to > the state of the user's > mailbox. One user only? What kind of configuration do you have, MailScanner + MailWatch? > My plan is to delete this existing mailbox and create a new one for the user. > My > question is, is/are there steps that I can take prior to doing the above act? > Are there file(s) that I can > look at or modify to correct this issue? Thanks. Why delete the mailbox? are you sure it is corrupted? I don't even see what the mailbox has to do with the above message: it is the result of scanning one incoming mail message, it hasn't even tried to deliver the message. It all depends on your specific configuration, my guess is that you use MailScanner but I don't know if you use it with the recommended perl clamav module, with clamscan, or you modified MS to use clamdscan. In the most usual situation the perl module is used and a few parameters can be set in MS configuration that can affect those timeouts. The obvious one is the explicit timeout setting, but there are others that produce the same error message, like recursion level (inside zip files), and something else I don't recall right now. - -- René Berber -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (Cygwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFE18X4L3NNweKTRgwRAmffAKDyHjE2Jy+Hq+z/RnD03AUeDCVWWgCfeHii 9rtqDYb9fQ1d4F5YwnqZ0Bk= =H2Kl -----END PGP SIGNATURE----- _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
