Disclaimer: I haven't implemented ClamAV with Declude, so I'm guessing here...
It sounds like the max-ratio solution is a red herring. It sounds like ClamAV returned an error because it couldn't scan the overlarge file (compressed or not). It sounds like Gary's configuration is quarantining emails based on any non-zero return code from ClamAV and that this is not the behaviour he really wants. Comments? Flames? Andrew 8) > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Scott Fisher > Sent: Thursday, September 07, 2006 7:02 AM > To: [email protected] > Subject: Re: [Declude.Virus] Oversized.RAR FOUND in ClamAV > > I used (and probably posted the --max-ratio 0 ). > > The max-ratio defines the "maximum compression ratio for > scanned files." I kept getting legit text files that were > zipped that were over ratio, so that's why I why I went to > the max-ration 0. > > ----- Original Message ----- > From: "Gary Steiner" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Wednesday, September 06, 2006 9:31 PM > Subject: [Declude.Virus] Oversized.RAR FOUND in ClamAV > > > I have an email that was held as a virus after ClamAV was > triggered with the > result "Oversized.RAR FOUND". I looked for an explanation > but couldn't find > anything detailed. Apparently this is due to some type of > bug in ClamAV > that shows up with certain RAR or ZIP files. > > I found one posting that suggested that the problem could be fixed by > adjusting the max-ratio value. The default max-ratio value > for ClamAV is > 250. The suggested value for running it with Declude is 0. > What would be > the safest value to run with and why? > > Gary > > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
