Hi folks,
I'm still testing 0.102.3 but I've hit a few issues where some known-good files
are being detected as infected because they're generating the following error:
Can't allocate memory ERROR
Output from clamscan and clamdscan are as follows:
> $ /usr/local/bin/clamscan /Applications/Microsoft\
> Excel.app/Contents/SharedSupport/Microsoft.Mashup.Container.app/Contents/SharedSupport/System.ValueTuple.dll
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 0
> Engine version: 0.102.3
> Scanned directories: 0
> Scanned files: 1
> Infected files: 1
> Data scanned: 0.00 MB
> Data read: 0.01 MB (ratio 0.00:1)
> Time: 0.009 sec (0 m 0 s)
>
> Escalate:/Applications $ /usr/local/bin/clamdscan --multiscan
> /Applications/Microsoft\
> Excel.app/Contents/SharedSupport/Microsoft.Mashup.Container.app/Contents/SharedSupport/System.ValueTuple.dll
> /Applications/Microsoft
> Excel.app/Contents/SharedSupport/Microsoft.Mashup.Container.app/Contents/SharedSupport/System.ValueTuple.dll:
> Can't allocate memory ERROR
>
> ----------- SCAN SUMMARY -----------
> Infected files: 0
> Total errors: 1
> Time: 0.002 sec (0 m 0 s)
> Escalate:/Applications $
I removed main.cvd and bytecode.cvd from the database directory, unpacked
daily.cvd and eventually tracked it down to daily.crb
Removing the following definition solves the problem, but for some reason this
can't be added to an ign2 file...and this sig worked on older versions of
clamav, so it feels like that's the wrong solution anyway!
Trusted.CA.Microsoft-7350512-0
Has anyone else come up against this problem before, and do you know what I can
do about it?
Many thanks
Mark
_______________________________________________
clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel
Please submit your patches to our Github:
https://github.com/Cisco-Talos/clamav-devel/pulls
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
