[clamav-users] No filenames listed by clamscan.

David Raynor draynor at sourcefire.com
Tue Mar 4 10:59:34 EST 2014


On Sat, Mar 1, 2014 at 11:01 AM, J. W. Andersen <jwa at fasytek.dk> wrote:

> After upgrading from 0.97.6  to 0.98.1 I get the following messages on the
> console:
>
> LibClamAV: Warning: SWF: Invalid tag length.
> LibClamAV: Warning: SWF: Invalid tag length.
> LibClamAV: Warning: SWF: Invalid tag length.
> LibClamAV: Warning: SWF: Invalid tag length.
> LibClamAV: Warning: fmap:  map allocation failed.
> LibClamAV: Error: CRITICAL: fmap () failed.
> LibClamAV: Warning: SWF: Invalid tag length.
>
> upon scanning a large linux directory (some 60 GB) with clamscan.
>
> The real problem is, that clamscan does not tell me which scanned files
> it is actually complaining about, not in sysout and not in syserr. With
> some
> 10,000 files in the directory it is impossible for me to find out which
> files to correct or get rid of. I can prevent the "Invalid tag length" by
> setting the --scan-archives to no, but that is hardly a solution if I want
> the archives thoroughly scanned.
>
> Can anyone tell me, what I shall do to retrieve the name of the
> problematic files ?
>
> Regards, Joern W. Andersen
>
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> http://www.clamav.net/support/ml
>

It is probable that these are all tied to the Flash file scanning (which
was completely disabled in 0.97.6).

Try this: Run your scan with "--scan-swf=no" instead of
"--scan-archives=no". That is a more targeted shut-off.

Let me know how it goes. I'm tracking a possibly-related issue.

Dave R.

-- 
---
Dave Raynor
Vulnerability Research Team
draynor at sourcefire.com



More information about the clamav-users mailing list