[clamav-users] Suggestion: Need option to "Block Skipped Files" and Scan Summary to indicate "Skipped files"

'Andy Schmidt' Andy_Schmidt at HM-Software.com
Thu Sep 15 01:44:11 EDT 2016


Hi,

 

I didn't know if I was supposed to use the "Bug Reporting" system, as this
really is reporting an issue with how the software operates "as designed".

 

Currently, ClamAV will indicate whether an infected file was found - THAT
condition is non-ambiguous.

 

However, when ClamAV reports:

 

----------- SCAN SUMMARY -----------

Infected files: 0

 

It actually can be highly misleading.

 

If one of the scanned files exceeded some of the limits, such as:

 

MaxScanSize 150M

MaxFileSize 150M

#MaxRecursion 16

#MaxFiles 10000

then the actual "infected" status of that file is completely unknown! The
end-user has no warning that the file was NOT virus-scanned!

May I respectfully suggest:

a)    A config option "BlockSkipped yes"
(equivalent to the already existing "ArchiveBlockEncrypted yes".
This way, the user can opt to receive a specific message indicating which
limit prevented a file from being scanned, rather than being "lulled" into
thinking that everything is "A-OK".
An automated process that incorporate ClamAV would be able to take a
different path, e.g., require the user to scrutinize the file more
carefully.



b)    An appropriate line in the SCAN SUMMARY, e.g.:
----------- SCAN SUMMARY -----------
Infected files: 0
Skipped files: 1
Time: 1.610 sec (0 m 1 s)

Thank for giving this suggestion your consideration.

Best Regards
Andy Schmidt 

 




More information about the clamav-users mailing list