> > > Ah... you should call action_discard() (at least for the specific > > Oblivion.rar case...) > > Understood but trying to solve the larger issue. If you > rename the file to > say bob.temp or zip the file (say you have a rar in a zip), > the problem > still occurs.
Two useful approaches: Clamd.conf: =========== ScanArchive ArchiveMaxRecursion 5 ArchiveMaxFiles 1000 ArchiveMaxFileSize 10M ArchiveMaxCompressionRatio 250 ArchiveBlockMax This will limit the size of files when uncompressing, and will also prevent massive files from being allowed through - the "ArchiveBlockMax" option reports files as viruses if they fail any of the size, recursion or file count checks. Mimedefang-filter: ================== Have two lists of bad file extensions - those which are not allowed anywhere, and those which are not allowed in ZIP files. Add ZIP, RAR, BZ2, etc to this list even if you allow them normally - recursive archives are to be strongly discouraged. Paul. -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.4.1/309 - Release Date: 11/04/2006 _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
