ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
GuitarBob


Joined: 09 Jul 2006
Posts: 4292
Location: USA
Reply with quote
I'm sure the developers will see this thread and address it. Meantime, you might increase your scan limit size to see what that does.

Regards,
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
More infomation and further test.

One of the error files, properties:

Quote:
Name: Moulin Rouge!.m4v
Type: MP4 Video (.m4v)
Size: 1.49 GB (1,602,529,552 bytes)

An individual scan of the files showing the error:

Code:
Scan Started Wed Jan 13 21:39:50 2016
-------------------------------------------------------------------------------

D:\BackupStore\Music\iTunes\iTunes Media\Music\Movies\Moulin Rouge!.m4v: Can't allocate memory ERROR

----------- SCAN SUMMARY -----------
Known viruses: 4321820
Engine version: 0.98.7
Scanned directories: 0
Scanned files: 0
Infected files: 0

Total errors: 1
Data scanned: 0.00 MB
Data read: 1528.29 MB (ratio 0.00:1)
Time: 17.129 sec (0 m 17 s)

--------------------------------------
Completed
--------------------------------------


And yet, another file of similar properties, the only difference being the size and the scan shows no errors:

Quote:
Name: Charlie Wilson's War.m4v
Type: MP4 Video (.m4v)
Size: 1.11 GB (1,196,084,817 bytes)


Code:
Scan Started Wed Jan 13 21:41:12 2016
-------------------------------------------------------------------------------


----------- SCAN SUMMARY -----------
Known viruses: 4321820
Engine version: 0.98.7
Scanned directories: 0
Scanned files: 1
Infected files: 0

Data scanned: 0.00 MB
Data read: 1140.67 MB (ratio 0.00:1)
Time: 17.160 sec (0 m 17 s)

--------------------------------------
Completed
--------------------------------------


This suggests that it is size causing the problem and that the threshold of the problem begins above 1.11GB and under 1.4GB file sizes.

I hope the developers see this, find it interesting and can offer some resolve. Remeber, this was NOT a problem in v0.97 (and started only after upgrade to 0.98 )
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
Can you find any other files that you have that are inbetween 1.11gb and 1.4gb to confirm your issue? Also, have you tried some basic fixes, such as seeing if you still have the program for which those files came from (aka. could be dead files), and also have you tried a complete uninstall and reinstall of ClamWin to see if that did the trick?
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Ok,....

There are 2x files that produce the ERRORs and they are both at the 1.4GB mark. The next largest file size down is the 1.11 (detailed above) and that doesnt error. There are no other files above this size. The only other files I have that are larger are ZIP archive files (at 8GB) but they are exempt from scanning normally but even an on-access scan of them doesnt error. (Zips are different though, arent they.)

They are all working m4v video files (films from iTunes downloads). There are other m4V's that are also smaller and they dont have a problem.

Yes I have uninstalled and reinstalled several times.

EDIT:

I did find a windows Index file at 2.0GB :

name: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci
size: 2.09 GB (2,255,200,256 bytes)

Just did a manual scan on it and it seems to complete ok. I say "ok", it actually correctly didnt scan it because it was too big (according to my file size limit of 20MB in configuration). Note the "data scanned = 0.00". (I would expect the same from the above files because they equally are too big but still it complains).

Code:

Scan Started Wed Jan 13 22:13:48 2016
-------------------------------------------------------------------------------


----------- SCAN SUMMARY -----------
Known viruses: 4323038
Engine version: 0.98.7
Scanned directories: 0
Scanned files: 1
Infected files: 0

Data scanned: 0.00 MB
Data read: 4192358.73 MB (ratio 0.00:1)
Time: 17.519 sec (0 m 17 s)

--------------------------------------
Completed
--------------------------------------


So maybe we are talking about a combination of file type + size causing problems?
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Reckon this could have done with reporting to ClamAV in case it is something in the original coding but....

ClamAV 'Report A Bug' page says:
Quote:
"If you find a bug in ClamAV, please check it against the latest git code. Read the instructions below, then visit our bug tracker to submit your bug report. Please do not submit bugs for third party software."

I cant read 'git code' and Clamwin is a thirdparty software. I conclude this as that page continues to give advice on how to submit various system variables and they use all Linux commands such as kernel core dumps and (therefore no provision for equivalent windows commands).

Humph!!
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4292
Location: USA
Reply with quote
I believe this error message should be suppressed (hidden) by the ClamWin developers in the future. Most viruses are in files that are less than 1 MB in size--they would be too visible in larger files.

Regards,
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
I think my discussion about this is more on a matter of principal rather than it causing a function or fundamental error. I say it because:

a, having log files saying ERRORS encountered in them can cause worry and unnecessary investigation (land the frequency of this could lead to possibly overlooking genuine errors that needs attention)
b, No developer wants random errors. And this is random. As said above:
i, it never happened in 0.97 -the cause of this was introduced in 0.98
ii, I have 'scan file size limit' set at 20mb so it should be ignoring these anyway
iii, other files that are stupidly large are not erroring the same way (therefore no reason is obvious)

So I dont think its a case of 'suppressing' or hiding the error in the log, more about fixing the cause of the error so it wouldnt be generated in the first place. After all, if there is an unexplained condition causing this error then how can we or the developers be sure that there arent other strange conditions that may well be more serious?
View user's profileSend private message
ROCKNROLLKID


Joined: 23 Sep 2013
Posts: 562
Location: **UNKNOWN**
Reply with quote
Actually, once long ago, before Cisco acquired Sourcefire, ClamAV and ClamWin use to be in close contact and helped each other out. ClamWin is actually just a Windows ported version of ClamAV with a simple GUI on top. Many users of ClamWin have reported errors to the ClamAV community in the past. I think you are OK to send this to ClamAV team.

I also will go ahead and send this to Alch, since .99 beta testing is still going on.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
jimimaseye wrote:
I think my discussion about this is more on a matter of principal rather than it causing a function or fundamental error. I say it because:

a, having log files saying ERRORS encountered in them can cause worry and unnecessary investigation (land the frequency of this could lead to possibly overlooking genuine errors that needs attention)
b, No developer wants random errors. And this is random. As said above:
i, it never happened in 0.97 -the cause of this was introduced in 0.98
ii, I have 'scan file size limit' set at 20mb so it should be ignoring these anyway
iii, other files that are stupidly large are not erroring the same way (therefore no reason is obvious)

So I dont think its a case of 'suppressing' or hiding the error in the log, more about fixing the cause of the error so it wouldnt be generated in the first place. After all, if there is an unexplained condition causing this error then how can we or the developers be sure that there arent other strange conditions that may well be more serious?


Most likely it is the internal processing of a video file that throws clamav engine off. We could investigate it if you made one of the files that triggers an error available for download.

Thanks,
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Sure. Can you send me (email me) an email address (Im sure you have my registration details), and I will email you a link for you to download it.
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
Hi Alex, link emailed. Any more info required then do of course shout up.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
jimimaseye wrote:
Hi Alex, link emailed. Any more info required then do of course shout up.

Got it, thanks!
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 894
Location: Italy
Reply with quote
Clamav tries to "map" the entire file but it does not have enough contiguous memory, on demand scan on a single file ignores file limits

update: looks like clamav ignores the limit also scanning a directory
View user's profileSend private message
jimimaseye


Joined: 04 Jan 2014
Posts: 93
Reply with quote
And does a schedule scan of, say, d: constitute 'scanning a folder'? Because that's when this error also happens. (If so when exactly is the file size limit actually adhered to? )

Also how was I able to successfully scan a .CI file of 2.2GB without the error and yet not the 1.4GB m4v file (both on demand)?
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 894
Location: Italy
Reply with quote
jimimaseye wrote:
And does a schedule scan of, say, d: constitute 'scanning a folder'? Because that's when this error also happens. (If so when exactly is the file size limit actually adhered to? )

Also how was I able to successfully scan a .CI file of 2.2GB without the error and yet not the 1.4GB m4v file (both on demand)?


unfortunately the file size is checked after "mapping" the file, you currently cannot scan such a big file with the 32bit version of clamav, you need 64bit binaries,
alex what about adding also 64bit binaries to the installer? obviously you still need 32bit libclamav for pyc


Last edited by sherpya on Thu Jan 21, 2016 5:30 pm; edited 1 time in total
View user's profileSend private message
Clamwin 0.98 scan ALWAYS shows 2 undefined/undetailed errors
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 2 of 3  

  
  
 Reply to topic