[clamav-users] ClamWin finds malware, ClamAV doesn't.

[Jay Gattuso]

I’m trying to get clamd running as a service so I can fire files/streams at it via pyclam.

I’m working on win7.

I have a test file that shows a Win.Trojan.URLspoof-2 warning.

ClamWin:

----------- SCAN SUMMARY -----------
Known viruses: 4660817
Engine version: 0.99.1
Scanned directories: 0
Scanned files: 1
Infected files: 1

Data scanned: 85.88 MB
Data read: 99.27 MB (ratio 0.87:1)
Time: 10.720 sec (0 m 10 s)

--------------------------------------
Completed
--------------------------------------

ClamAV:

C:\Program Files\clamav-amd64-0.99.2>freshclam
ClamAV update process started at Thu Jul 21 06:51:27 2016
main.cvd is up to date (version: 57, sigs: 4218790, f-level: 60, builder: amishhammer)
daily.cvd is up to date (version: 21938, sigs: 447370, f-level: 63, builder: neo)
bytecode.cvd is up to date (version: 283, sigs: 53, f-level: 63, builder: neo)

C:\Program Files\clamav-amd64-0.99.2>clamscan C:\Users\_____\Desktop\NLNZ-TI9
5846839-20160630231930-00008-kaiwae-z4.warc


----------- SCAN SUMMARY -----------
Known viruses: 4660817
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 99.27 MB (ratio 0.00:1)
Time: 7.847 sec (0 m 7 s)

clamscan wouldn’t work until I fired freshclam.
Clamd.conf points towards the clamwin db files.
The pyclam endgame also doesn’t find anything. I assume its working from the clamav clamd service.


What am I missing? / What else do you need to know to help me trouble shoot?


Jay Gattuso | Digital Preservation Analyst | Preservation, Research and Consultancy
National Library of New Zealand | Te Puna Mātauranga o Aotearoa
PO Box 1467 Wellington 6140 New Zealand | [phone]
***@dia.govt.nz<mailto:***@natlib.govt.nz>

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin

[G.W. Haywood]

Hi there,

Post by Jay Gattuso
What am I missing? / What else do you need to know to help me trouble shoot?

You are probably using different configuration files for the two scans.

Find them and you might have your answer. If not, post them here.

[Kevin Lin]

clamd.conf does not affect the behavior of clamscan which is why you needed
to run freshclam first to pull database to the default database location.
Thus, there is a possibility that the databases may be mismatched though
it's unlikely as the signature is still part of the current set. In order
to change the clamscan directory from the default, you need to use the '-d'
option.

clamscan -d [database directory] [sample]

Secondly, the versions of ClamAV differ between the two test cases (ClamWin
uses 0.99.1 and clamscan uses 0.99.2). However, there doesn't seem to be
any engine changes that would affect the signature in question.

Thirdly, it appears that ClamWin reports that it scans 85.88 MB while
clamscan reports it scans 0 MB (both read 99.27 MB). It is possible that
the engine is not scanning the file though the reason is uncertain. The
reason could be deduced from comparing the debug logs. It might also be
worth it to provide the logs here as well. Unfortunately, I'm not familiar with
generating debug logs with ClamWin. clamscan will generate the debug log if
you specify "--debug" to it on the command line.

clamscan --debug [sample]

For additional information on clamscan options, refer to the clamscan
manpage or use the the "--help" option.

clamscan --help

Finally, if you suspect that this may be a bug, please report the issue to
https://bugzilla.clamav.net and supply the appropriate samples.

-Kevin

Post by Jay Gattuso
I’m trying to get clamd running as a service so I can fire files/streams
at it via pyclam.
I’m working on win7.
I have a test file that shows a Win.Trojan.URLspoof-2 warning.
----------- SCAN SUMMARY -----------
Known viruses: 4660817
Engine version: 0.99.1
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 85.88 MB
Data read: 99.27 MB (ratio 0.87:1)
Time: 10.720 sec (0 m 10 s)
--------------------------------------
Completed
--------------------------------------
C:\Program Files\clamav-amd64-0.99.2>freshclam
ClamAV update process started at Thu Jul 21 06:51:27 2016
amishhammer)
daily.cvd is up to date (version: 21938, sigs: 447370, f-level: 63,
builder: neo)
neo)
C:\Program Files\clamav-amd64-0.99.2>clamscan
C:\Users\_____\Desktop\NLNZ-TI9
5846839-20160630231930-00008-kaiwae-z4.warc
----------- SCAN SUMMARY -----------
Known viruses: 4660817
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
Data read: 99.27 MB (ratio 0.00:1)
Time: 7.847 sec (0 m 7 s)
clamscan wouldn’t work until I fired freshclam.
Clamd.conf points towards the clamwin db files.
The pyclam endgame also doesn’t find anything. I assume its working from
the clamav clamd service.
What am I missing? / What else do you need to know to help me trouble
shoot?
Jay Gattuso | Digital Preservation Analyst | Preservation, Research and
Consultancy
National Library of New Zealand | Te Puna Mātauranga o Aotearoa
PO Box 1467 Wellington 6140 New Zealand | [phone]
_______________________________________________
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clama

[Jay Gattuso]

Thanks for your questions and suggestions.

I had a look via the --debug method, and found the following in the clamAV call:-

LibClamAV debug: cli_updatelimits: filesize exceeded (allowed: 26214400, needed: 104096320)

To check this, I ran clamAV with an eicar string test and got the expected hit:

D:\clamav_testing\EICAR_string.py: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 4667494
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 7.622 sec (0 m 7 s)

Is there somewhere in the clamAV config I can set the cli_updatelimits: filesize to be larger?

In the install dir I only see clamd.conf and freshclam.conf:

TCPSocket 3310
MaxThreads 2
LogFile C:\working\clam_av_logs\clamd.txt
DatabaseDirectory C:\Program Files\clamav-amd64-0.99.2\db




DatabaseMirror database.clamav.net
DNSDatabaseInfo current.cvd.clamav.net



Thanks,

J


Jay Gattuso
***********************
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Al Varnell]

You might be able to re-compile the ClamAV source and configure it with --maxfilesize=xxM, but the limit is there to prevent severe system damage that can result from attempting to scan over-sized files. I know in the case of OS X there is no known malware that exceed the established limits.

-Al-

Post by Jay Gattuso
Thanks for your questions and suggestions.
I had a look via the --debug method, and found the following in the clamAV call:-
LibClamAV debug: cli_updatelimits: filesize exceeded (allowed: 26214400, needed: 104096320)

<snip>

Post by Jay Gattuso
Is there somewhere in the clamAV config I can set the cli_updatelimits: filesize to be larger?
TCPSocket 3310
MaxThreads 2
LogFile C:\working\clam_av_logs\clamd.txt
DatabaseDirectory C:\Program Files\clamav-amd64-0.99.2\db

[Kevin Lin]

The filesize limit can be dynamically set for clamscan with the
"--max-filesize=xxM" option. clamd.conf can be used to change the clamd
filesize limit with "MaxFileSize".

Excerpt from clamscan help:
----
--max-filesize=#n Files larger than this will be
skipped and assumed clean
--max-scansize=#n The maximum amount of data to scan
for each container file (**)
--max-files=#n The maximum number of files to
scan for each container file (**)
----

Excerpt from clamd.conf manpage:
----
MaxScanSize SIZE
Sets the maximum amount of data to be scanned for each input
file. Archives and other containers are recursively extracted and scanned
up to this value. The size of an archive plus the sum of the sizes of all
files within archive count toward the scan size. For example, a 1M
uncompressed archive containing a single 1M inner file counts as 2M toward
the max scan size. Warning: disabling this limit or setting it too
high may result
in severe damage to the system.
Default: 100M

MaxFileSize SIZE
Files larger than this limit won't be scanned. Affects the
input file itself as well as files contained inside it (when the input file
is an archive, a document or some other kind of container). Warning:
disabling this limit or setting it too high may result in severe damage to
the system.
Default: 25M

...

MaxFiles NUMBER
Number of files to be scanned within an archive, a document,
or any other kind of container. Warning: disabling this limit or setting it
too high may result in severe damage to the system.
Default: 10000
----

As said earlier, be careful with expanding the engine limits as scanning
oversized files can be dangerous.

-Kevin

Post by Al Varnell
You might be able to re-compile the ClamAV source and configure it with
--maxfilesize=xxM, but the limit is there to prevent severe system damage
that can result from attempting to scan over-sized files. I know in the
case of OS X there is no known malware that exceed the established limits.
-Al-

Post by Jay Gattuso
Thanks for your questions and suggestions.
I had a look via the --debug method, and found the following in the

clamAV call:-

Post by Jay Gattuso
LibClamAV debug: cli_updatelimits: filesize exceeded (allowed: 26214400,

needed: 104096320)
<snip>
filesize to be larger?

Post by Jay Gattuso
TCPSocket 3310
MaxThreads 2
LogFile C:\working\clam_av_logs\clamd.txt
DatabaseDirectory C:\Program Files\clamav-amd64-0.99.2\db

_______________________________________________
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Dennis Peterson]

ClamAV is both an email/attachment scanner and a file system scanner. It is
pointless to set the email scanner to scan files larger than your MTA is
configured to accept. Secondarily, the interface between the MTA and ClamAV
frequently has a max filesize parameter, too. This is to prevent DOS'ing your
own system. This means only that the clamd.conf file used for file scanning is
possibly inappropriate for use as an email scanner. And there is absolutely no
reason people cannot run multiple instances of clamd on a system so long as each
has its own clamdxx.conf and port/socket/log settings.

dp

Post by Kevin Lin
The filesize limit can be dynamically set for clamscan with the
"--max-filesize=xxM" option. clamd.conf can be used to change the clamd
filesize limit with "MaxFileSize".
----
--max-filesize=#n Files larger than this will be
skipped and assumed clean
--max-scansize=#n The maximum amount of data to scan
for each container file (**)
--max-files=#n The maximum number of files to
scan for each container file (**)
----
----
MaxScanSize SIZE
Sets the maximum amount of data to be scanned for each input
file. Archives and other containers are recursively extracted and scanned
up to this value. The size of an archive plus the sum of the sizes of all
files within archive count toward the scan size. For example, a 1M
uncompressed archive containing a single 1M inner file counts as 2M toward
the max scan size. Warning: disabling this limit or setting it too
high may result
in severe damage to the system.
Default: 100M
MaxFileSize SIZE
Files larger than this limit won't be scanned. Affects the
input file itself as well as files contained inside it (when the input file
disabling this limit or setting it too high may result in severe damage to
the system.
Default: 25M
...
MaxFiles NUMBER
Number of files to be scanned within an archive, a document,
or any other kind of container. Warning: disabling this limit or setting it
too high may result in severe damage to the system.
Default: 10000
----
As said earlier, be careful with expanding the engine limits as scanning
oversized files can be dangerous.
-Kevin

Post by Al Varnell
You might be able to re-compile the ClamAV source and configure it with
--maxfilesize=xxM, but the limit is there to prevent severe system damage
that can result from attempting to scan over-sized files. I know in the
case of OS X there is no known malware that exceed the established limits.
-Al-

Post by Jay Gattuso
Thanks for your questions and suggestions.
I had a look via the --debug method, and found the following in the

clamAV call:-

Post by Jay Gattuso
LibClamAV debug: cli_updatelimits: filesize exceeded (allowed: 26214400,

needed: 104096320)
<snip>
filesize to be larger?

Post by Jay Gattuso
TCPSocket 3310
MaxThreads 2
LogFile C:\working\clam_av_logs\clamd.txt
DatabaseDirectory C:\Program Files\clamav-amd64-0.99.2\db

_______________________________________________
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml

_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml