Mailing List Archive

[clamav-users] malwarepatrol.db invalid
Is anyone able to successfully use the malwarepatrol.db file?

I'm running clamav 0.102.4, I've verified the md5 of the download, but every single time I try it dies with database integrity tested BAD.

LibClamAV Error: Malformed pattern line 827
LibClamAV Error: Problem parsing database at line 827

I've tried emailing malwarepatrol but with no response.

Any pointers gladly received!

Regards
Steve
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
Hi there,

On Mon, 29 Mar 2021, Steve Hanselman wrote:

> Is anyone able to successfully use the malwarepatrol.db file?

Haven't used it since 2013.

> I'm running clamav 0.102.4, I've verified the md5 of the download, but every single time I try it dies with database integrity tested BAD.
>
> LibClamAV Error: Malformed pattern line 827
> LibClamAV Error: Problem parsing database at line 827

Is this when clamd tries to load it? Or clamscan? What do you see at
line 827? Can you simply remove that line/signature/whatever? If it
is a signature, perhaps you can post it here, or upload it somewhere
and post a link. Perhaps it's a pattern that can only be parsed by
0.103.x, or by a regex library you aren't using, or whatever - but I
don't know if there can be such patterns.

> I've tried emailing malwarepatrol but with no response.

No comment.

> Any pointers gladly received!

I don't do social media, but there might be something there:

https://www.facebook.com/malwarepatrol/
https://twitter.com/malwarepatrol?lang=en

I tried to look at the facebook page but it said

"Benjamin, your account has been locked, click here to..."

I have no idea who Benjamin might be, and I gave up there.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
On 29 March 2021 15:04:17 Steve Hanselman <steveh@brendata.co.uk> wrote:
> Is anyone able to successfully use the malwarepatrol.db file?
>
>
>
> I’m running clamav 0.102.4, I’ve verified the md5 of the download, but
> every single time I try it dies with database integrity tested BAD.
>
>
>
> LibClamAV Error: Malformed pattern line 827
>
> LibClamAV Error: Problem parsing database at line 827

Could you post 5 lines before and 5 lines after line 827...

Cheers,

Steve
Twitter: @sanesecurity
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
MBL_83042387=646f776e31312e7a6f6c2e636f6d2e636e2f646f776e736a627a2f786873362e38312e3077253235323532353235323532353235323532353235323532353235323534303134385f36363233322e657865
MBL_83042389=672e70636f6e6c696e652e636f6d2e636e2f646c2f776170646c5f73706565645f313238393136365f393534313235372f66696c652f333630796a7a6a2532353235323532353235323532353262383637313925323532353235323532353235323532626e326566616663383739312e6578652f333630796a7a6a2532353235323532353235323532353262383637313925323532353235323532353235323532626e326566616663383739312e6578652f333630796a7a6a2532353235323532353235323532353262383637313925323532353235323532353235323532626e326566616663383739312e657865
MBL_83042391=3131332e36312e3230342e3230353a3336333835
MBL_83042403=672e70636f6e6c696e652e636f6d2e636e2f646c2f776170646c5f73706565645f313238393136365f393534313235372f66696c652f333630796a7a6a2532353235323532353262383637313925323532353235323532626e326566616663383739312e6578652f333630796a7a6a2532353235323532353262383637313925323532353235323532626e326566616663383739312e6578652f333630796a7a6a2532353235323532353262383637313925323532353235323532626e326566616663383739312e657865
MBL_83042406=627a776b2e6d697377656c742e636f6d2f68646f796a742f30316a3932353225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353865253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235386225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353965253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235386225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561392532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353932253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235613225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561362532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353964253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235626625323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532356134253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235623925323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561382532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353861253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235616625323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561362532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353964253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235626625323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532356231253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235386225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561392532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353964253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235613225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532353866253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235386125323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561352532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532356132253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235393925323532353235323532353235323532353235323563332532353235323532353235323532353235323532353833253235323532353235323532353235323532353235633225323532353235323532353235323532353235323561342532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383225323532353235323532353235323532353235323563322532353235323532353235323532353235323532356264253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235393325323532353235323532353235323532353235323532362532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383325323532353235323532353235323532353235323563322532353235323532353235323532353235323532356134253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235623925323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323539302532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383325323532353235323532353235323532353235323563322532353235323532353235323532353235323532356136253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235623825323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323562382532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383325323532353235323532353235323532353235323563322532353235323532353235323532353235323532356137253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235396225323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323539322532353235323532353235323532353235323532356333253235323532353235323532353235323532353235383325323532353235323532353235323532353235323563322532353235323532353235323532353235323532356135253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538322532353235323532353235323532353235323532356332253235323532353235323532353235323532353235616425323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323539305f70797a313033322d3830675f3338373132372e657865
MBL_83042407=627a776b2e6d697377656c742e636f6d2f68646f796a742f34253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538332532353235323532353235323532353235323532356332253235323532353235323532353235323532353235383425323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323562302532353235323532353235323532353235323532353236253235323532353235323532353235323532353235633325323532353235323532353235323532353235323538332532353235323532353235323532353235323532356332253235323532353235323532353235323532353235386525323532353235323532353235323532353235323563332532353235323532353235323532353235323532353832253235323532353235323532353235323532353235633225323532353235323532353235323532353235323562615f70797a313033312d3830675f353639322e657865
MBL_83042409=6b726169746e61612e636f6d2f77702d636f6e74656e742f7468656d65732f6d6f6f6e2d62792d6f736574696e
MBL_83042410=6b726169746e61612e636f6d2f77702d636f6e74656e742f7468656d65732f6d6f6f6e2d62792d6f736574696e
MBL_83042415=6e617679726164696f31352e636f6d2f696d61676573
MBL_83042417=70656e7369756e6561797570707964752e636f6d2f696d61676573
MBL_83042422=7330322e736f6c696466696c657375736572636f6e74656e742e636f6d2f796a6d777a6a79357a7771316d6d65326f746b346d6a79356e6475346e64657a6f7471316f747a6c7a7461316f6779777a74617a6e7a6f78616d66686f787536726b316d7333707575336a7965766f77746b78757533663162787665716a766c637734302f677776706c67346472707167622f6d61696c746f2532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353361737570706f72742532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353235323532353430736f6c696466696c65732e636f6d


Regards
Steve


From: clamav-users [mailto:clamav-users-bounces@lists.clamav.net] On Behalf Of Steve Basford
Sent: 29 March 2021 16:44
To: ClamAV users ML
Subject: Re: [clamav-users] malwarepatrol.db invalid


On 29 March 2021 15:04:17 Steve Hanselman <steveh@brendata.co.uk> wrote:
Is anyone able to successfully use the malwarepatrol.db file?

I’m running clamav 0.102.4, I’ve verified the md5 of the download, but every single time I try it dies with database integrity tested BAD.

LibClamAV Error: Malformed pattern line 827
LibClamAV Error: Problem parsing database at line 827

Could you post 5 lines before and 5 lines after line 827...

Cheers,

Steve
Twitter: @sanesecurity
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
Hi there,

On Mon, 29 Mar 2021, Steve Hanselman wrote:

> ...
> MBL_83042406=627a776b2e[...]
> ...

This appears to be the problem signature. Try removing it?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
On Mon, 2021-03-29 at 14:03 +0000, Steve Hanselman wrote:
> Is anyone able to successfully use the malwarepatrol.db file?

I've contacted malwarepatrol about this but it never got resolved. As
far as I know, it's still issue #16509 with them.

The problem is that sometimes the "extended" signature URL returns the
"normal" (i.e. not extended) signatures. This happens somewhat
randomly; usually they send one or the other for a few days in a row,
but then switch to the other type without warning.

Thing is, the "extended" signature databases should have an "ndb"
extension while the normal (i.e. not extended) signature databases
should have a "db" extension. If they don't, verification will fail.
So, which filename do you pick? Whichever one you choose is going to be
wrong after they randomly flip the contents on you in a week.



_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [clamav-users] malwarepatrol.db invalid [ In reply to ]
Will do, many thanks



Sent from my Galaxy



-------- Original message --------
From: "G.W. Haywood via clamav-users" <clamav-users@lists.clamav.net>
Date: 29/03/2021 18:04 (GMT+00:00)
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: "G.W. Haywood" <clamav@jubileegroup.co.uk>
Subject: Re: [clamav-users] malwarepatrol.db invalid

Hi there,

On Mon, 29 Mar 2021, Steve Hanselman wrote:

> ...
> MBL_83042406=627a776b2e[...]
> ...

This appears to be the problem signature. Try removing it?

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml