Kaplan, Andrew H. wrote:
> I am running clamav 0.88.1 on an HP-UX 10.20 trusted workstation. I am getting a
> series of the following error messages in the mail.log file:
>
> Commercial Scanner ClamAV Timed Out!
> Virus Scanning: Denial of Service attack detected!
That's from MailScanner, indirectly from clamav.
> This appears to be affecting only one user. However, that user is getting virus
> warnings on virtually all his incoming mail. I am guessing the user's mailbox is somehow corrupted and the
> vast majority of these messages are false positives that are attributed to the state of the user's
> mailbox.
One user only? What kind of configuration do you have, MailScanner + MailWatch?
> My plan is to delete this existing mailbox and create a new one for the user. My
> question is, is/are there steps that I can take prior to doing the above act? Are there file(s) that I can
> look at or modify to correct this issue? Thanks.
Why delete the mailbox? are you sure it is corrupted? I don't even see what the
mailbox has to do with the above message: it is the result of scanning one
incoming mail message, it hasn't even tried to deliver the message.
It all depends on your specific configuration, my guess is that you use
MailScanner but I don't know if you use it with the recommended perl clamav
module, with clamscan, or you modified MS to use clamdscan.
In the most usual situation the perl module is used and a few parameters can be
set in MS configuration that can affect those timeouts. The obvious one is the
explicit timeout setting, but there are others that produce the same error
message, like recursion level (inside zip files), and something else I don't
recall right now.
- --
René Berber
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
(text/plain)