On 2011-10-10 10:24, Alex wrote:
> Hi,
>
> I have a fedora15 x86_64 box with clamav-0.97.2, postfix-2.8.4, and
> amavisd-new-2.6.6 with spamassassin-3.3.2 that has been running fine
> for quite a while. Recently, clamd has died with an error similar to
> this:
>
> Oct 10 02:55:56 mail02 amavis[25696]: (25696-18) (!)run_av
> (ClamAV-clamscan) FAILED - unexpected exit 2, output="LibClamAV
> Error:cli_hex2str(): Malformed hexstring: 22|20 (length: 5)\nLibClamAV
> Error: cli_parse_add(): Problem adding signature (3).
scanners.c:1667 returns a string split using '|' as delimiter, so I don't see
how
hex2str at 1672 can report that it still has a '|'.
Try running memtest86(+) to check that your RAM is fine.
Also what does the clamav-unofficial-sigs log say about the InetMsg database?
Does it report that the integrity test worked when it tested the database with
clamscan?
>
> Is this a corrupt database? I'm using the clamav-unofficial-sigs
> script to verify the updates and it hasn't reported a problem.
> Restarting clamd apparently resolves the issue temporarily.
>
> It has failed two or three times now over the course of about five
> days, so it generally works properly.
>
> The content of INetMsg-SpamDomains-2w.ndb at line 40734 is:
>
> INetMsg.SpamDomain-2w.lakecharmvila_com:4:*:(2e|2f|40|20|3c|5f)6c616b65636861726d76696c612e636f6d(27|22|20|2f|3d|5f|3e|0a|0d)
This is a valid database entry, are you sure this is the one causing clamscan
to fail with the above message?
Maybe the database got updated in the meantime with a corrected entry.
>
> # md5sum INetMsg-SpamDomains-2w.ndb
> 06d95496ef6e60fdee63dcf431c06b48 INetMsg-SpamDomains-2w.ndb
>
> # sigtool --find-sigs INetMsg.SpamDomain-2w.lakecharmvila_com |
> sigtool --decode-sigs
> VIRUS NAME: INetMsg.SpamDomain-2w.lakecharmvila_com
> TARGET TYPE: MAIL
> OFFSET: *
> DECODED SIGNATURE:
> {CHAR_ALTERNATIVE:.|/|@| |<|_}lakecharmvila.com{CHAR_ALTERNATIVE:'|"|
> |/|=|_|>|
> }
>
> Thanks for any ideas.
> Alex
> _______________________________________________
> Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
> http://www.clamav.net/support/ml
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
