I get false positives on zipped Siemens PLC(SPS)-Programms

[pire13]

Hi everybody,

Siemens PLC-Programms (SPS-Programme) have many small files and they can be compressed from 30mb to 1.5mb so clamAV reports a virus oversized.zip (look at http://www.clamav.net/support/faq) we've increased the parameter ArchiveMaxCompressionRatio in clamav.conf but the parameter gets overwritten.
Is there a possibility to change it on a place where it keeps his value?

best regards,

jakob birnbaumer

 

[tom]

Hi everybody,

Siemens PLC-Programms (SPS-Programme) have many small files and they can be compressed from 30mb to 1.5mb so clamAV reports a virus oversized.zip (look at http://www.clamav.net/support/faq) we've increased the parameter ArchiveMaxCompressionRatio in clamav.conf but the parameter gets overwritten.
Is there a possibility to change it on a place where it keeps his value?

best regards,

jakob birnbaumer

Hi Jakob,

Did you edit the conf file directly? This is not recommended as these files are overwritten. If you need to edit config files directly, just ask here for a howto (depends on the file).

We built a nice web interface for changing values, so please go to Configuration/Virus detector/Options and set your value.

(Max archive compression ratio (ClamAV)