[Clamav-devel] Virus scan result for comand line not working for relative paths

Tue Sep 10 15:01:34 UTC 2024

I was partly confused about what you meant when you said, "relative path".  I think you meant UNC path (Universal Naming Convention path). Since you're on Windows, I think you can do this scan with the directory slashes the other way, like:

clamscan.exe    --recursive   --stdout \\10.67.0.161\Docs\ENVTEST_MC

Note: I recommend against using "--remove".  False positive detections happen sometimes, and I would hate for one to cause you to lose an important document.

But I am not sure it will work.  I don't have a network share readily accessible to test it myself.  Though I did confirm that on Windows I can scan using the UNC path for my C: drive, like this:

❯ clamscan.exe \\?\c:\dell.sdr
C:\dell.sdr: OK

----------- SCAN SUMMARY -----------
Known viruses: 1
Engine version: 0.103.11
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.07 MB
Data read: 0.04 MB (ratio 1.73:1)
Time: 0.041 sec (0 m 0 s)
Start Date: 2024:09:09 11:36:04
End Date:   2024:09:09 11:36:04

Regards,
Micah

Micah Snyder (they/them)
ClamAV Development
Talos
Cisco Systems, Inc.

________________________________
From: Hasitha Dewapriya <hdewapriya at veryon.com>
Sent: Monday, September 9, 2024 12:55 AM
To: ClamAV Development <clamav-devel at lists.clamav.net>
Cc: Micah Snyder (micasnyd) <micasnyd at cisco.com>
Subject: Re: Virus scan result for comand line not working for relative paths

I am trying to do a virus scan in a shared folder path using the ClamAV command line tool.

Command I am using is

clamscan    --recursive   --stdout   --remove //10.67.0.161/Docs/ENVTEST_MC

Following is the output I am getting

----------- SCAN SUMMARY -----------
Known viruses: 8697864
Engine version: 1.4.0
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 24.637 sec (0 m 24 s)
Start Date: 2024:08:30 15:27:52
End Date:   2024:08:30 15:28:17

I am scanning virus file downloaded from https://www.eicar.org/download-anti-malware-testfile/

So Infected files should be 1.

Same file, Same command work correctly in a absolute path. Command like following

clamscan    --recursive   --stdout   --remove D:\RD\Temp

Any gues why this is not working.

[cid:image-102-2549118 at localhost]<http://rs1.veryon.com/rs/a0tyF4T1>

Hasitha Dewapriya
Senior Software Engineer
O: +44 3333 440730
hdewapriya at veryon.com<mailto:hdewapriya at veryon.com>
Let’s Get You More Uptime®
veryon.com<https://www.veryon.com/> | 1-800-747-4560<tel:1-800-747-4560> | learnmore at veryon.com<mailto:learnmore at veryon.com>
Connect with us on social media!<https://veryon.com/social-media>

**Important notice: Rusada is now part of Veryon. My email domain has changed from @rusada.com to @veryon.com, please update your records with my new email address.**

From: clamav-devel <clamav-devel-bounces at lists.clamav.net> on behalf of Micah Snyder (micasnyd) via clamav-devel <clamav-devel at lists.clamav.net>
Sent: Thursday, September 5, 2024 8:51 PM
To: ClamAV Development <clamav-devel at lists.clamav.net>
Cc: Micah Snyder (micasnyd) <micasnyd at cisco.com>
Subject: Re: [Clamav-devel] Virus scan result for comand line not working for relative paths

Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, forward this message to spam at veryon.com.

Please clarify what you're trying to do.  The thing you pasted as a relative path.... what... is it?  What is the command you're running for the scan?

Micah Snyder (they/them)
ClamAV Development
Talos
Cisco Systems, Inc.
________________________________
From: clamav-devel <clamav-devel-bounces at lists.clamav.net> on behalf of Hasitha Dewapriya via clamav-devel <clamav-devel at lists.clamav.net>
Sent: Wednesday, September 4, 2024 2:14 AM
To: clamav-devel at lists.clamav.net <clamav-devel at lists.clamav.net>
Cc: Hasitha Dewapriya <hdewapriya at veryon.com>
Subject: [Clamav-devel] Virus scan result for comand line not working for relative paths

Hi,

The following shows scan output for the same file in absolute path and a relative path in windows 11 environment. I want this to be work in relative path also. Please check

Absolute path output (D:\RD\Temp) everything is OK.

----------- SCAN SUMMARY -----------
Known viruses: 8697864
Engine version: 1.4.0
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 24.018 sec (0 m 24 s)
Start Date: 2024:08:30 15:18:48
End Date:   2024:08:30 15:19:12

Relative path ([file://\\10.67.0.<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/>xxx\DB_Docs\ENVTEST_MC\<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/<file://\\10.67.0.<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/>xxx\DB_Docs\ENVTEST_MC\<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/]\\10.67.0.<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/>xxx\DB_Docs\ENVTEST_MC\<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/<file://\\10.67.0.<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/>xxx\DB_Docs\ENVTEST_MC\<https://outlook.office.com/local/path/file://10.67.0.161/DB_Docs/ENVTEST_MC/>>)
All required data is missing

----------- SCAN SUMMARY -----------
Known viruses: 8697864
Engine version: 1.4.0
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 24.637 sec (0 m 24 s)
Start Date: 2024:08:30 15:27:52
End Date:   2024:08:30 15:28:17

_______________________________________________

clamav-devel mailing list
clamav-devel at lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
-------------- next part --------------
A non-text attachment was scrubbed...
Name: RSImage.png
Type: image/png
Size: 6061 bytes
Desc: RSImage.png
URL: <https://lists.clamav.net/pipermail/clamav-devel/attachments/20240910/0e6f4a25/attachment.png>