[clamav-users] Scanning a zip file fails, extract it, scan with the same options and it passes

[Max Allan]

Hi Andrew,

The .zip file (252M compressed / 58M zipped) and offending file
(2683/9069bytes)
All well less than the maximums on the CLI (2GB) and by no means the
largest file.


Rubbing salt in the wound, the return code when it exceeds heuristics
is "1" which the man page says :

> Return Codes
> 0 : No virus found.
> 1 : Virus(es) found.
> 2 : Some error(s) occured.

Surely it should be a "2" not a "1".

Anyway, after running with --debug and -v I found an error about
exceeding scan time. Added  --max-scantime=120000000
And now it does "the right thing". (scan doesn't report a virus found)

Thanks,
Max

On Mon, 4 Oct 2021 at 15:31, Andrew C Aitchison <clamav at aitchison.me.uk> wrote:
>
> What are the compressed and uncompressed sizes of the problem file ?
>

> >
> > /usr/local/openjdk-11/lib/src.zip: Heuristics.Limits.Exceeded FOUND
> > /usr/local/openjdk-11/lib/src.zip!(0)ZIP:jdk.zipfs/jdk/nio/zipfs/ZipInfo.java:
> > Heuristics.Limits.Exceeded FOUND
> > ---------- SCAN SUMMARY -----------
> > Known viruses: 8570214
> > Engine version: 0.103.3
> > Scanned directories: 0
> > Scanned files: 1
> > Infected files: 1
> > Data scanned: 290.07 MB