We have a customer who sent an email through us that was a short text body with an Excel spreadsheet attachment. The attachment is about 988K and the entire email is about 1.3M. For some reason, when ClamAV parses the Excel file, it winds up creating about 2300 files and taking up about 1.3 *gig* of space. Because there are multiple copies, it's running the tmp out if space, causing the message to fail.
Running debug, it says it thinks it "Matched signature for file type CAB-SFX at 35233". Why would it think an Excel file is a cab file? I've opened it to check, and it really is just a spreadsheet of 12 pages. I've tried various options, but it doesn't seem to make any difference. It started happening in production on 0.95.3, but it does the same thing on 0.96. I have about 800k lines of debug output I can try to cut down if that will help. We can also contact the customer to see if they'll let us submit the file if you'd like to check it. Any ideas on how to get this properly scanned would be appreciated. -- Brian Bebeau [email protected] _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
