[clamav-users] No filenames listed by clamscan. (solved)

J. W. Andersen jwa at fasytek.dk
Tue Mar 4 12:13:29 EST 2014


Hi David - thanks for your reply. As I already wrote in reply to 
mcmurchy1917-clamav at yahoo.co.uk,
I created a  large logfile with all good and bad stuff logged, and then 
searched out LibClamAV
messages. A search exclusively for .SWF files in the specified directory 
gave nothing, but the
troublesome files were obviously hidden in various archives, in this 
case one .cab file, one .iso
image file, and two self-installing .exe programs.

Thans again for your efforts.

Joern.-

#################################################

Den 04-03-2014 16:59, David Raynor skrev:
> On Sat, Mar 1, 2014 at 11:01 AM, J. W. Andersen <jwa at fasytek.dk> wrote:
>
>> After upgrading from 0.97.6  to 0.98.1 I get the following messages on the
>> console:
>>
>> LibClamAV: Warning: SWF: Invalid tag length.
>> LibClamAV: Warning: SWF: Invalid tag length.
>> LibClamAV: Warning: SWF: Invalid tag length.
>> LibClamAV: Warning: SWF: Invalid tag length.
>> LibClamAV: Warning: fmap:  map allocation failed.
>> LibClamAV: Error: CRITICAL: fmap () failed.
>> LibClamAV: Warning: SWF: Invalid tag length.
>>
>> upon scanning a large linux directory (some 60 GB) with clamscan.
>>
>> The real problem is, that clamscan does not tell me which scanned files
>> it is actually complaining about, not in sysout and not in syserr. With
>> some
>> 10,000 files in the directory it is impossible for me to find out which
>> files to correct or get rid of. I can prevent the "Invalid tag length" by
>> setting the --scan-archives to no, but that is hardly a solution if I want
>> the archives thoroughly scanned.
>>
>> Can anyone tell me, what I shall do to retrieve the name of the
>> problematic files ?
>>
>> Regards, Joern W. Andersen
>>
>> _______________________________________________
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/vrtadmin/clamav-faq
>> http://www.clamav.net/support/ml
>>
> It is probable that these are all tied to the Flash file scanning (which
> was completely disabled in 0.97.6).
>
> Try this: Run your scan with "--scan-swf=no" instead of
> "--scan-archives=no". That is a more targeted shut-off.
>
> Let me know how it goes. I'm tracking a possibly-related issue.
>
> Dave R.
>

-- 


More information about the clamav-users mailing list