[clamav-users] What causes ClamMisc to fail scanning?

[dee heffemm]

On 9/23/21, G.W. Haywood via clamav-users <clamav-users at lists.clamav.net> wrote:
> Hi there,

Hi, and thanks!

>
> I would suggest that if you're investigating problems with scanning by
> clamd, which is what clamonacc uses for the scanning, then clamdscan
> might be better a better choice than clamscan for the investigations.

Interesting. I tried clamdscan and it DOES report an error with that
file (whereas clamscan does not). As the clamav user however, I'm able
to read it via the 'file' command. ps shows clamd  running as the
'clamav' user so I'm stumped as to what's going on here. I'm going to
have to run the clamd process via strace or something..

both fuser and lsof return nothing when given the path to that
filename so I don't think there are any multi-user/locking/thread
issues there. I even tried stopping apache and still not able to
clamdscan it

test# sudo -u clamav /bin/bash --login

test$ ls -lart /var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png
-rw-rw-r-- 1 passenger passenger 1766 Jan 25  2019
/var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png

test$ file /var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png
/var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png:
PNG image data, 180 x 180, 8-bit colormap, non-interlaced

test$ clamdscan --verbose
/var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png
/var/www/passenger/app1/shared/public/assets/favicon-ipad-3f9d14b84a660e5f92e9936caff986b1265746037c15421e693821c15b483444.png:
Can't open file or directory ERROR

----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.000 sec (0 m 0 s)
Start Date: 2021:09:23 10:58:02
End Date:   2021:09:23 10:58:02