Re: [Declude.Virus] ClamAV?

2005-02-17 Thread Matt




If so, that's one to add to the Declude Virus manualScott?

Matt



Scott Fisher wrote:

  Try adding this to your command line:
--max-ratio 0

The support compression ratio feature (--max-ratio). Overly compressed files
may get falsely detected. I believe the 0 turns it off.
it worked for me.

- Original Message - 
From: "Hirthe, Alexander" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, February 17, 2005 11:34 AM
Subject: [Declude.Virus] ClamAV?


  
  
Hello,

I'm getting errors with Zip Files larger than about 10 MB.

In the virus.log:
02/17/2005 17:12:03 Qbede796f012201de MIME file: 123.zipxxx [base64;
Length=13024694 Checksum=1676135806]
02/17/2005 17:12:07 Qbede796f012201de Scanner 3: Virus= Attachment= [6] O
02/17/2005 17:12:07 Qbede796f012201de File(s) are INFECTED [: 1]
02/17/2005 17:12:07 Qbede796f012201de Scanned: CONTAINS A VIRUS [MIME: 2
13024860]
The file is without any virus. Sure :)

from virus.cfg:
SCANFILE3 C:\clamav-devel\bin\clamscan.exe --quiet --log-verbose
--no-summary -l report.txt
VIRUSCODE3 1
REPORT3 FOUND

Has anyone else such errors?
The user told me, this could/would happen with all zipped files larger

  
  than
  
  
6 MB.

Alex
---
[This E-mail was scanned for viruses by Declude Virus

  
  (http://www.declude.com)]
  
  
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  
  
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


  


-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=




Re: [Declude.Virus] ClamAV?

2005-02-17 Thread Scott Fisher
Try adding this to your command line:
--max-ratio 0

The support compression ratio feature (--max-ratio). Overly compressed files
may get falsely detected. I believe the 0 turns it off.
it worked for me.

- Original Message - 
From: "Hirthe, Alexander" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, February 17, 2005 11:34 AM
Subject: [Declude.Virus] ClamAV?


> Hello,
>
> I'm getting errors with Zip Files larger than about 10 MB.
>
> In the virus.log:
> 02/17/2005 17:12:03 Qbede796f012201de MIME file: 123.zipxxx [base64;
> Length=13024694 Checksum=1676135806]
> 02/17/2005 17:12:07 Qbede796f012201de Scanner 3: Virus= Attachment= [6] O
> 02/17/2005 17:12:07 Qbede796f012201de File(s) are INFECTED [: 1]
> 02/17/2005 17:12:07 Qbede796f012201de Scanned: CONTAINS A VIRUS [MIME: 2
> 13024860]
> The file is without any virus. Sure :)
>
> from virus.cfg:
> SCANFILE3 C:\clamav-devel\bin\clamscan.exe --quiet --log-verbose
> --no-summary -l report.txt
> VIRUSCODE3 1
> REPORT3 FOUND
>
> Has anyone else such errors?
> The user told me, this could/would happen with all zipped files larger
than
> 6 MB.
>
> Alex
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.Virus mailing list.  To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.Virus".The archives can be found
> at http://www.mail-archive.com.
>

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


[Declude.Virus] ClamAV?

2005-02-17 Thread Hirthe, Alexander
Hello,

I'm getting errors with Zip Files larger than about 10 MB.

In the virus.log:
02/17/2005 17:12:03 Qbede796f012201de MIME file: 123.zipxxx [base64;
Length=13024694 Checksum=1676135806]
02/17/2005 17:12:07 Qbede796f012201de Scanner 3: Virus= Attachment= [6] O
02/17/2005 17:12:07 Qbede796f012201de File(s) are INFECTED [: 1]
02/17/2005 17:12:07 Qbede796f012201de Scanned: CONTAINS A VIRUS [MIME: 2
13024860]
The file is without any virus. Sure :)

from virus.cfg:
SCANFILE3 C:\clamav-devel\bin\clamscan.exe --quiet --log-verbose
--no-summary -l report.txt
VIRUSCODE3 1
REPORT3 FOUND

Has anyone else such errors? 
The user told me, this could/would happen with all zipped files larger than
6 MB. 

Alex
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.


Re: [Declude.Virus] ClamAV?

2005-02-17 Thread William Stillwell
Manually perform the scan, and look @ the report.txt file.
- Original Message - 
From: "Hirthe, Alexander" <[EMAIL PROTECTED]>
To: 
Sent: Thursday, February 17, 2005 12:34 PM
Subject: [Declude.Virus] ClamAV?


Hello,
I'm getting errors with Zip Files larger than about 10 MB.
In the virus.log:
02/17/2005 17:12:03 Qbede796f012201de MIME file: 123.zipxxx [base64;
Length=13024694 Checksum=1676135806]
02/17/2005 17:12:07 Qbede796f012201de Scanner 3: Virus= Attachment= [6] O
02/17/2005 17:12:07 Qbede796f012201de File(s) are INFECTED [: 1]
02/17/2005 17:12:07 Qbede796f012201de Scanned: CONTAINS A VIRUS [MIME: 2
13024860]
The file is without any virus. Sure :)
from virus.cfg:
SCANFILE3 C:\clamav-devel\bin\clamscan.exe --quiet --log-verbose
--no-summary -l report.txt
VIRUSCODE3 1
REPORT3 FOUND
Has anyone else such errors?
The user told me, this could/would happen with all zipped files larger 
than
6 MB.

Alex
---
[This E-mail was scanned for viruses by Declude Virus 
(http://www.declude.com)]

---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.
---
This email has been scanned for possible viruses by Declude Antivirus.
For more information on Declude Antivirus, Visit www.declude.com

---
This email has been scanned for possible viruses by Declude Antivirus.
For more information on Declude Antivirus, Visit www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.Virus mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.Virus".The archives can be found
at http://www.mail-archive.com.