Mailing List Archive

[clamav-users] issues with EICAR-test-file
Hi altogether,

in order to test clamscan/clamdscan I used the *EICAR-Testfile* provided
on https://de.wikipedia.org/wiki/EICAR-Testdatei .

I named it /EICAR-Testdatei.txt/.
Yet scanning it with either *clamscan* or *clamdscan* gave me different
results:

- _with clamdscan:_

clamdscan EICAR-Testdatei.txt
/home/rosika2/Dokumente/kgw/EICAR-Testdatei.txt: Eicar-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.183 sec (0 m 0 s)


- _with clamscan:_

clamscan ./EICAR-Testdatei.txt
LibClamAV Error: mpool_malloc(): Can't allocate memory (262144 bytes).
LibClamAV Error: hm_addhash_bin: failed to grow hash array to 1 entries
LibClamAV Error: cli_loadhash: Malformed hash string at line 48894
LibClamAV Error: cli_loadhash: Problem parsing database at line 48894
LibClamAV Error: Can't load main.hsb: Can't allocate memory
LibClamAV Error: cli_tgzload: Can't load main.hsb
LibClamAV Error: Can't load /var/lib/clamav/main.cvd: Malformed database
LibClamAV Error: cli_loaddbdir(): error loading database
/var/lib/clamav/main.cvd
ERROR: Malformed database

----------- SCAN SUMMARY -----------
Known viruses: 2424459
Engine version: 0.102.2
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 7.633 sec (0 m 7 s)


What am I doing wrong here?

Thanks in advance for your help.

Greetings.
Rosika

P.S.:

My system: Linux/BodhiLinux 5.1.0 in VM
Re: [clamav-users] issues with EICAR-test-file [ In reply to ]
Citeren Christian <abelschreck3@freenet.de>:

> Hi altogether,
>
> in order to test clamscan/clamdscan I used the *EICAR-Testfile* provided
> on https://de.wikipedia.org/wiki/EICAR-Testdatei .
>
> I named it /EICAR-Testdatei.txt/.
> Yet scanning it with either *clamscan* or *clamdscan* gave me different
> results:
>
> - _with clamdscan:_
>
> clamdscan EICAR-Testdatei.txt
> /home/rosika2/Dokumente/kgw/EICAR-Testdatei.txt: Eicar-Signature FOUND
>
> ----------- SCAN SUMMARY -----------
> Infected files: 1
> Time: 0.183 sec (0 m 0 s)
>
>
> - _with clamscan:_
>
> clamscan ./EICAR-Testdatei.txt
> LibClamAV Error: mpool_malloc(): Can't allocate memory (262144 bytes).
> LibClamAV Error: hm_addhash_bin: failed to grow hash array to 1 entries
> LibClamAV Error: cli_loadhash: Malformed hash string at line 48894
> LibClamAV Error: cli_loadhash: Problem parsing database at line 48894
> LibClamAV Error: Can't load main.hsb: Can't allocate memory
> LibClamAV Error: cli_tgzload: Can't load main.hsb
> LibClamAV Error: Can't load /var/lib/clamav/main.cvd: Malformed database
> LibClamAV Error: cli_loaddbdir(): error loading database
> /var/lib/clamav/main.cvd
> ERROR: Malformed database
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 2424459
> Engine version: 0.102.2
> Scanned directories: 0
> Scanned files: 0
> Infected files: 0
> Data scanned: 0.00 MB
> Data read: 0.00 MB (ratio 0.00:1)
> Time: 7.633 sec (0 m 7 s)
>
>
> What am I doing wrong here?

Your system is running out of memory. Both clamscan and clamdscan need
a little over 1 GB of memory (mostly signatures), which means that
you'll need at least 4 GB if you want to run them both at the same time.

> Thanks in advance for your help.
>
> Greetings.
> Rosika
>
> P.S.:
>
> My system: Linux/BodhiLinux 5.1.0 in VM




_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
[clamav-users] issues with EICAR-test-file [ In reply to ]
Hello Arjen,


thank you so much for your reply,

> Your system is running out of memory.

O.K., that´s the explanation then.
Running BodhiLinux in a VM (qemu/kvm) I originally assigned 1 GB of
virtual RAM to it.
I changend that to 2 GB and now indeed clamdscan and clamscan work:


clamdscan EICAR-Testdatei.txt
/home/rosika2/Dokumente/kgw/EICAR-Testdatei.txt: Eicar-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 0.044 sec (0 m 0 s)

AND:

clamscan ./EICAR-Testdatei.txt
./EICAR-Testdatei.txt: Eicar-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 6930494
Engine version: 0.102.2
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 28.218 sec (0 m 28 s)

Thanks a lot again for your help.

Greetings.
Rosika


_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml