Re: [Clamav-devel] clamd false positive, (Oversized.Zip on small zip files)
On Monday 14 May 2007, Tomasz Kojm wrote: Martin Blapp [EMAIL PROTECTED] wrote: What do you propose ? Is there a easy config fix for clamd or are we lost ? man clamd.conf Are you remember it ? ;-) === Subject: Re: [clamd/clamscan (?)] Oversized.RAR false positives From: Tomasz Kojm [EMAIL PROTECTED] To: Sergey Y. Afonin [EMAIL PROTECTED] Date: 2004-11-29 01:37 On Sat, 27 Nov 2004 10:42:04 +0400 Sergey Y. Afonin [EMAIL PROTECTED] wrote: Subject: [wish] ArchiveMaxCompressionRatio Date: Wednesday 24 November 2004 12:16 From: Sergey [EMAIL PROTECTED] To: [EMAIL PROTECTED] ^ should be @lists.clamav.net checked archive and to not check Compression Ratio for archives, which in the unpacked no more X: NoCheckCompressionRatioBefore 10M Good idea! -- oo. Tomasz Kojm [EMAIL PROTECTED] (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Sun Nov 28 22:37:04 CET 2004 === -- Regards, Sergey ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
[Clamav-devel] clamd false positive, (Oversized.Zip on small zip files)
Hi all, While scanning http://antispam.imp.ch/files/testzip.zip clamd (clamdscan) thinks that this file is too big. But it isn't the case at all. All extracted files are only about 1MB in size. We have set 'ArchiveMaxCompressionRatio' to 200, so this can't really be the problem. For some reason, clamscan thinks the archive is ok. Only clamd has this problem. clamd --version ClamAV 0.90.2/3243/Mon May 14 12:49:49 2007 Any ideas ? Martin Blapp, [EMAIL PROTECTED] [EMAIL PROTECTED] -- ImproWare AG, UNIXSP ISP, Zurlindenstrasse 29, 4133 Pratteln, CH Phone: +41 61 826 93 00 Fax: +41 61 826 93 01 PGP: finger -l [EMAIL PROTECTED] PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E -- ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] clamd false positive, (Oversized.Zip on small zip files)
On Mon, 14 May 2007 15:01:53 +0200 (CEST) Martin Blapp [EMAIL PROTECTED] wrote: Hi all, While scanning http://antispam.imp.ch/files/testzip.zip clamd (clamdscan) thinks that this file is too big. But it isn't the case at all. All extracted files are only about 1MB in size. We have set 'ArchiveMaxCompressionRatio' to 200, so this can't really be the problem. For some reason, clamscan thinks the archive is ok. Only clamd has this problem. clamd --version ClamAV 0.90.2/3243/Mon May 14 12:49:49 2007 Any ideas ? 60032 / 241 = 249.09544 -- oo. Tomasz Kojm [EMAIL PROTECTED] (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Mon May 14 15:11:34 CEST 2007 ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] clamd false positive, (Oversized.Zip on small zip files)
Hi, 60032 / 241 = 249.09544 Hmm ? If I extract this Zip file I get 842 Kbytes Data, not 60032, which is only 3 times as much. How do you get 60032 Kbytes ? -- Martin ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
Re: [Clamav-devel] clamd false positive, (Oversized.Zip on small zip files)
On Mon, 14 May 2007 16:05:21 +0200 (CEST) Martin Blapp [EMAIL PROTECTED] wrote: Hi, 60032 / 241 = 249.09544 Hmm ? If I extract this Zip file I get 842 Kbytes Data, not 60032, which is only 3 times as much. How do you get 60032 Kbytes ? /tmp$ unzip -lv testzip.zip | head -n 5 | tail -n 1 60032 Defl:X 241 100% 02-16-07 13:15 1c5aa12b Drops von 14V 30s.dpt -- oo. Tomasz Kojm [EMAIL PROTECTED] (\/)\. http://www.ClamAV.net/gpg/tkojm.gpg \..._ 0DCA5A08407D5288279DB43454822DC8985A444B //\ /\ Mon May 14 16:10:08 CEST 2007 ___ http://lurker.clamav.net/list/clamav-devel.html Please submit your patches to our Bugzilla: http://bugs.clamav.net
