ClamWin Free Antivirus :: View topic

Posted: Mon Sep 24, 2007 7:13 pm

We use clamscan.exe to scan e-mails passing through our mail server. We've recently had two messages with legitimate PDF attachments flagged as infected with "Oversized.PDF". The most recent PDF to be blocked was less than 2 MB, which of course, isn't very large. I sent myself a test message with a PDF of about 2.8 MB, and it went through just fine. So what is "Oversized.PDF", why is it catching some legitimate, moderately sized PDFs, and how do I stop it? Thanks.

Posted: Mon Sep 24, 2007 11:31 pm

you can control this by using
--max-ratio option

Posted: Tue Sep 25, 2007 12:00 am

jcw_av wrote:

So what is "Oversized.PDF", why is it catching some legitimate, moderately sized PDFs, and how do I stop it?

There are limits to the amount of data that clamav decompressed. PDFs in this regard are not much different than zips which there is a response to the result of "Oversized.Zip" below:

https://www.clamav.net/support/faq
wrote:

I get many false positives of Oversized.zip

* Whenever a file exceeds ArchiveMaxCompressionRatio (see clamd.conf man page), it’s considered a logic bomb and marked as Oversized.zip . Try increasing your ArchiveMaxCompressionRatio setting.

Posted: Tue Sep 25, 2007 6:03 pm

Thanks, that took care of it. I already had max-ratio at 300 for Oversized.Zip. I didn't realize that it also affected PDFs. ("Oversized" is a misnomer here if you ask me. It's not too big, it's just very compressed.) When I raised the value all the way to 999 the recent "bad" PDF goes through.