[Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Dave Shariff Yadallee - System Administrator a.k.a. The Root of the Problem 
Is their any way to tell Clamav to look at a file
before it is considered a Virus?

I got a call from a customer who said that Zip files
are getting intercepted by clamav and are defaulting them as a virus.
___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Chuck Swiger 
On Dec 5, 2006, at 1:36 PM, Dave Shariff Yadallee - System  
Administrator a.k.a. The Root of the Problem wrote:

Is their any way to tell Clamav to look at a file
before it is considered a Virus?

I got a call from a customer who said that Zip files
are getting intercepted by clamav and are defaulting them as a virus.


ClamAV doesn't consider all ZIP files to be viruses; I suggest you  
gather more information from your logs, and confirm what is going on.


--
-Chuck

___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] ZIP files autodetected as virus

2006-12-05 Thread Tom Samplonius 

- Dave Shariff Yadallee - System Administrator a.k.a. The Root of the 
Problem [EMAIL PROTECTED] wrote:
 Is their any way to tell Clamav to look at a file
 before it is considered a Virus?
 
 I got a call from a customer who said that Zip files
 are getting intercepted by clamav and are defaulting them as a virus.

  It depends on what you have configured ClamAV to do.  You can configure 
ClamAV to:

* Consider all password protected archives are infected (assume they are 
infected because they can't be checked)

(ArchiveBlockEncrypted)


* Consider all archives over a certain size to be infected.

(ArchiveBlockMax)


  So what have you configured ClamAV to do?

  Good thing you run ClamAV too, as you are also using the root@ account to 
send (and probably) e-mail.  That's generally a bad idea.  I think ClamAV can 
detect most mail bombs, but you but should probably not rely on ClamAV as your 
only security against a complete server compromise.


Tom
___
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html