[clamav-win32] Clamd terminating (Malformed database)

[Bret Miller]

Paul Whelan wrote:
> On 22 Aug 2008 at 14:18, Phil (Medway Hosting) wrote:
>
>   
>> ----- Original Message ----- 
>> From: "Martin Clayton" <local.mc.clamav-win32 at clayreed.com>
>> To: <clamav-win32 at lists.clamav.net>
>> Sent: Friday, August 22, 2008 12:35 PM
>> Subject: Re: [clamav-win32] Clamd terminating (Malformed database)
>>
>>
>>     
>>> In case it's just data corruption I'd delete data\*.cvd and re-run
>>> freshclam.
>>>       
>> Ok done - will have to wait and see now !! One thing I noticed - with the
>> old files, in the clam log it said:
>> Fri Aug 22 10:49:51 2008 -> Loaded 709009 signatures.
>> With the new defs, it now says:
>> Fri Aug 22 13:57:41 2008 -> Loaded 1113131 signatures.
>>
>> Does that figure sound right ? If it is then it certainly indicates the
>> originals were corrupt after all.
>>     
>
> From freshclam, the total of the main and daily is 401,469 (earlier today).  The number 
> (re)loaded by clamd can be different if you have extra signatures (from Sanesecurity 
> etc.), but that number seems way out. You may have some old versions there.
>
> I would either delete everything and do a complete reinstall, or carefully go through all 
> files where the signatures are and remove the old ones.  Old versions (<0.93) also used 
> subdirectories.
>   
I'd concur with Paul. I use the base plus SaneSecurity signatures, and 
clamd says:
Fri Aug 22 08:16:35 2008 -> Reading databases from c:\Program 
Files\clamAV\data
Fri Aug 22 08:16:39 2008 -> Loaded 423994 signatures.

So yes, 1,113,131 sounds way, way too high-- close to triple normal.

Bret