ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
ClamWin Free Antivirus Forum Index » Virus Scanner
Reply to topic
clamwin fail to scan files in some special directories.
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Wed Jul 16, 2008 4:10 am Reply with quote
I am a Taiwan user . I use traditional chinese win xp .
when I use clamwin to scan my computer memory,
the error message come out.

WARNING: Can't open file C:\Documents and Settings\PureFeather\桌面\偽‧行列\array30ex.exe, No such file or directory

I think the error is cause by the name "偽‧行列".
the period mark may lead to this problem.
I guess this is because my system use "BIG5" code.
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Thu Jul 17, 2008 12:03 am Reply with quote
this is strange, clamscan should use unicode filenaming
how do you scan the file ? (explorer shell ext or using clamwin gui)

can you check how it's converted the name by adding --debug in advanced tab -> additional command line options
and looking at the report?

thanks
View user's profileSend private message
the detail result
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Fri Jul 18, 2008 4:54 am Reply with quote
using :
clamscan.exe --debug --infected --bell --database=%cd%\data\db --log=c:\cavlog.txt --move=c:\ --memory --kill --unload
is there anything wrong ?
WinXP xp3 chinese edition

My Input method is "array"(行列輸入法) . It is base on "BIG5-2003"
the period code is an interpunction of chinese .
I use array to type in chinese .
To type this interpunction "‧" ===>>just press "w 1 5" in array
-------------------------------------------------------------------------------

*** Scanning Programs in Computer Memory ***
*** Memory Scan: using ToolHelp ***

WARNING: Can't open file C:\Documents and Settings\Default User\桌面\偽‧行列\keyhook.dll, No such file or directory
WARNING: Can't open file C:\Documents and Settings\Default User\桌面\偽‧行列\array30ex.exe, No such file or directory

*** Scanned 17 processes - 280 modules ***
*** Computer Memory Scan Completed ***


----------- SCAN SUMMARY -----------
Known viruses: 350245
Engine version: 0.93.1
Scanned directories: 0
Scanned files: 297
Infected files: 0
Data scanned: 117.18 MB
Time: 62.422 sec (1 m 2 s)
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Fri Jul 18, 2008 11:17 am Reply with quote
can you add --debug at the command line?

it should print a lot of spam and inside something like

LibClamAV debug: Path converted from \\?\c:\ClamAV/testcom.zip to \\?\c:\ClamAV\testcom.zip

it's better to redirect stderr to a file by adding 2>debug.txt at the end of the command
View user's profileSend private message
like that ?
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Fri Jul 18, 2008 11:53 am Reply with quote
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 0
LibClamAV debug: Section name: .text
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x2dd645 0x2de000
LibClamAV debug: VirtualAddress: 0x1000 0x1000
LibClamAV debug: SizeOfRawData: 0x2de000 0x2de000
LibClamAV debug: PointerToRawData: 0x1000 0x1000
LibClamAV debug: Section contains executable code
LibClamAV debug: Section's memory is executable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 1
LibClamAV debug: Section name: .rdata
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x4a21a 0x4b000
LibClamAV debug: VirtualAddress: 0x2df000 0x2df000
LibClamAV debug: SizeOfRawData: 0x4b000 0x4b000
LibClamAV debug: PointerToRawData: 0x2df000 0x2df000
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 2
LibClamAV debug: Section name: .data
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x2d244 0x2e000
LibClamAV debug: VirtualAddress: 0x32a000 0x32a000
LibClamAV debug: SizeOfRawData: 0xd000 0xd000
LibClamAV debug: PointerToRawData: 0x32a000 0x32a000
LibClamAV debug: Section's memory is writeable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 3
LibClamAV debug: Section name: .rsrc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x348 0x1000
LibClamAV debug: VirtualAddress: 0x358000 0x358000
LibClamAV debug: SizeOfRawData: 0x1000 0x1000
LibClamAV debug: PointerToRawData: 0x337000 0x337000
LibClamAV debug: ------------------------------------
LibClamAV debug: EntryPoint offset: 0x25592d (2447661)
LibClamAV debug: exeScanner: Section name: [.text] - Entropy 4.344268
LibClamAV debug: exeScanner: Section name: [.rdata] - Entropy 3.798875
LibClamAV debug: exeScanner: Section name: [.data] - Entropy 3.993633
LibClamAV debug: exeScanner: Section name: [.rsrc] - Entropy 0.618349
LibClamAV debug: exeScanner: Max entropy = 4.344268
LibClamAV debug: exeScanner: Entry Point rva: 0x25592d - raw: 0x25592d
LibClamAV debug: exeScanner: Signature check: Nothing found
WARNING: Can't open file C:\Documents and Settings\Default User\桌面\偽‧行列\array30ex.exe, No such file or directory
LibClamAV debug: exeScanner: CreateFileA failed 3
LibClamAV debug: Recognized MS-EXE/DLL file
LibClamAV debug: in cli_peheader
LibClamAV debug: Matched signature for file type PE
LibClamAV debug: e_lfanew == 224
LibClamAV debug: Machine type: 80386
LibClamAV debug: NumberOfSections: 5
LibClamAV debug: TimeDateStamp: Sat Jun 14 11:29:36 2008
LibClamAV debug: SizeOfOptionalHeader: e0
LibClamAV debug: File format: PE
LibClamAV debug: MajorLinkerVersion: 9
LibClamAV debug: MinorLinkerVersion: 0
LibClamAV debug: SizeOfCode: 0x1000
LibClamAV debug: SizeOfInitializedData: 0x12800
LibClamAV debug: SizeOfUninitializedData: 0x0
LibClamAV debug: AddressOfEntryPoint: 0x15b0
LibClamAV debug: BaseOfCode: 0x1000
LibClamAV debug: SectionAlignment: 0x1000
LibClamAV debug: FileAlignment: 0x200
LibClamAV debug: MajorSubsystemVersion: 5
LibClamAV debug: MinorSubsystemVersion: 0
LibClamAV debug: SizeOfImage: 0x17000
LibClamAV debug: SizeOfHeaders: 0x400
LibClamAV debug: NumberOfRvaAndSizes: 16
LibClamAV debug: Subsystem: Win32 GUI
LibClamAV debug: ------------------------------------
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Fri Jul 18, 2008 6:17 pm Reply with quote
hmm memory scan is not unicode aware, I need to enhance it Smile
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Tue Jul 22, 2008 11:32 am Reply with quote
I've added experimental support for this kind of paths,
it works for local files and for network files, but not for network path/machine name, i.e. \\box\share\nonansipath is ok \\box\nonansishare\path not

can you test putting these executables in clamwin/bin directory?
you don't need clamd and clamdscan
https://oss.netfarm.it/clamav/files/clamav-win32-0.93.3.7z https://oss.netfarm.it/clamav/files/clamav-win32-0.93.3.7z
View user's profileSend private message
Here are the details.
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Wed Jul 23, 2008 8:47 am Reply with quote
WARNING: Expected ERROR_INVALID_NAME/ERROR_BAD_NETPATH but got 3
WARNING: Can't open file C:\Documents and Settings\PureFeather\桌面\偽‧行列\keyhook.dll, No such file or directory
WARNING: Expected ERROR_INVALID_NAME/ERROR_BAD_NETPATH but got 3


LibClamAV debug: Section 0
LibClamAV debug: Section name: .text
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x4583 0x5000
LibClamAV debug: VirtualAddress: 0x1000 0x1000
LibClamAV debug: SizeOfRawData: 0x4600 0x4600
LibClamAV debug: PointerToRawData: 0x400 0x400
LibClamAV debug: Section contains executable code
LibClamAV debug: Section's memory is executable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 1
LibClamAV debug: Section name: .data
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x68 0x1000
LibClamAV debug: VirtualAddress: 0x6000 0x6000
LibClamAV debug: SizeOfRawData: 0x200 0x200
LibClamAV debug: PointerToRawData: 0x4a00 0x4a00
LibClamAV debug: Section's memory is writeable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 2
LibClamAV debug: Section name: .rsrc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0xa4a5 0xb000
LibClamAV debug: VirtualAddress: 0x7000 0x7000
LibClamAV debug: SizeOfRawData: 0xa600 0xa600
LibClamAV debug: PointerToRawData: 0x4c00 0x4c00
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 3
LibClamAV debug: Section name: .reloc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x398 0x1000
LibClamAV debug: VirtualAddress: 0x12000 0x12000
LibClamAV debug: SizeOfRawData: 0x400 0x400
LibClamAV debug: PointerToRawData: 0xf200 0xf200
LibClamAV debug: ------------------------------------
LibClamAV debug: EntryPoint offset: 0x7fe (2046)
LibClamAV debug: exeScanner: Section name: [.text] - Entropy 4.302172
LibClamAV debug: exeScanner: Section name: [.data] - Entropy 0.592531
LibClamAV debug: exeScanner: Section name: [.rsrc] - Entropy 3.769227
LibClamAV debug: exeScanner: Section name: [.reloc] - Entropy 4.327175
LibClamAV debug: exeScanner: Max entropy = 4.327175
LibClamAV debug: exeScanner: Entry Point rva: 0x13fe - raw: 0x7fe
LibClamAV debug: exeScanner: Signature check: Nothing found
WARNING: Can't open file C:\Documents and Settings\PureFeather\桌面\偽‧行列\keyhook.dll, No such file or directory
LibClamAV debug: exeScanner: CreateFileA failed 3
LibClamAV debug: Recognized MS-EXE/DLL file
LibClamAV debug: in cli_peheader
LibClamAV debug: Matched signature for file type PE
LibClamAV debug: e_lfanew == 232
LibClamAV debug: File type: DLL
LibClamAV debug: Machine type: 80386
LibClamAV debug: NumberOfSections: 4
LibClamAV debug: TimeDateStamp: Tue Apr 15 00:28:53 2008
LibClamAV debug: SizeOfOptionalHeader: e0
LibClamAV debug: File format: PE
LibClamAV debug: MajorLinkerVersion: 7
LibClamAV debug: MinorLinkerVersion: 10
LibClamAV debug: SizeOfCode: 0x2c00
LibClamAV debug: SizeOfInitializedData: 0xc00
LibClamAV debug: SizeOfUninitializedData: 0x0
LibClamAV debug: AddressOfEntryPoint: 0x33f1
LibClamAV debug: BaseOfCode: 0x1000
LibClamAV debug: SectionAlignment: 0x1000
LibClamAV debug: FileAlignment: 0x200
LibClamAV debug: MajorSubsystemVersion: 4
LibClamAV debug: MinorSubsystemVersion: 10
LibClamAV debug: SizeOfImage: 0x7000
LibClamAV debug: SizeOfHeaders: 0x400
LibClamAV debug: NumberOfRvaAndSizes: 16
LibClamAV debug: Subsystem: Win32 console
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Wed Jul 23, 2008 4:23 pm Reply with quote
I cannot reproduce the error 3, so I'm not sure it will work anyway
can you test this executable pls:
https://oss.netfarm.it/clamav/files/clamscan.7z https://oss.netfarm.it/clamav/files/clamscan.7z
unpack it in bin overwriting the old one
View user's profileSend private message
the detail .
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Thu Jul 24, 2008 1:42 pm Reply with quote
WARNING: Expected ERROR_INVALID_NAME/ERROR_BAD_NETPATH but got 3
WARNING: Expected ERROR_INVALID_NAME/ERROR_BAD_NETPATH but got 3
==================================================
LibClamAV debug: Section 0
LibClamAV debug: Section name: .text
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x11745 0x12000
LibClamAV debug: VirtualAddress: 0x1000 0x1000
LibClamAV debug: SizeOfRawData: 0x11800 0x11800
LibClamAV debug: PointerToRawData: 0x400 0x400
LibClamAV debug: Section contains executable code
LibClamAV debug: Section's memory is executable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 1
LibClamAV debug: Section name: .orpc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x1c2f 0x2000
LibClamAV debug: VirtualAddress: 0x13000 0x13000
LibClamAV debug: SizeOfRawData: 0x1e00 0x1e00
LibClamAV debug: PointerToRawData: 0x11c00 0x11c00
LibClamAV debug: Section contains executable code
LibClamAV debug: Section's memory is executable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 2
LibClamAV debug: Section name: .data
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x2594 0x3000
LibClamAV debug: VirtualAddress: 0x15000 0x15000
LibClamAV debug: SizeOfRawData: 0x2600 0x2600
LibClamAV debug: PointerToRawData: 0x13a00 0x13a00
LibClamAV debug: Section's memory is writeable
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 3
LibClamAV debug: Section name: .rsrc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x448 0x1000
LibClamAV debug: VirtualAddress: 0x18000 0x18000
LibClamAV debug: SizeOfRawData: 0x600 0x600
LibClamAV debug: PointerToRawData: 0x16000 0x16000
LibClamAV debug: ------------------------------------
LibClamAV debug: Section 4
LibClamAV debug: Section name: .reloc
LibClamAV debug: Section data (from headers - in memory)
LibClamAV debug: VirtualSize: 0x2704 0x3000
LibClamAV debug: VirtualAddress: 0x19000 0x19000
LibClamAV debug: SizeOfRawData: 0x2800 0x2800
LibClamAV debug: PointerToRawData: 0x16600 0x16600
LibClamAV debug: ------------------------------------
LibClamAV debug: EntryPoint offset: 0x6bd (1725)
LibClamAV debug: exeScanner: Section name: [.text] - Entropy 3.577252
LibClamAV debug: exeScanner: Section name: [.orpc] - Entropy 2.437089
LibClamAV debug: exeScanner: Section name: [.data] - Entropy 2.805375
LibClamAV debug: exeScanner: Section name: [.rsrc] - Entropy 1.822724
LibClamAV debug: exeScanner: Section name: [.reloc] - Entropy 4.158918
LibClamAV debug: exeScanner: Max entropy = 4.158918
LibClamAV debug: exeScanner: Entry Point rva: 0x12bd - raw: 0x6bd
LibClamAV debug: exeScanner: Signature check: Nothing found
WARNING: Can't open file C:\Documents and Settings\Default User\桌面\偽‧行列\keyhook.dll, No such file or directory
LibClamAV debug: exeScanner: CreateFileA failed 3
LibClamAV debug: Recognized MS-EXE/DLL file
LibClamAV debug: in cli_peheader
LibClamAV debug: Matched signature for file type PE
LibClamAV debug: e_lfanew == 232
LibClamAV debug: File type: DLL
LibClamAV debug: Machine type: 80386
LibClamAV debug: NumberOfSections: 4
LibClamAV debug: TimeDateStamp: Tue Mar 15 12:06:02 2005
LibClamAV debug: SizeOfOptionalHeader: e0
LibClamAV debug: File format: PE
LibClamAV debug: MajorLinkerVersion: 7
LibClamAV debug: MinorLinkerVersion: 10
LibClamAV debug: SizeOfCode: 0x2c00
LibClamAV debug: SizeOfInitializedData: 0xe00
LibClamAV debug: SizeOfUninitializedData: 0x0
LibClamAV debug: AddressOfEntryPoint: 0x3407
LibClamAV debug: BaseOfCode: 0x1000
LibClamAV debug: SectionAlignment: 0x1000
LibClamAV debug: FileAlignment: 0x200
LibClamAV debug: MajorSubsystemVersion: 4
LibClamAV debug: MinorSubsystemVersion: 10
LibClamAV debug: SizeOfImage: 0x7000
LibClamAV debug: SizeOfHeaders: 0x400
LibClamAV debug: NumberOfRvaAndSizes: 16
LibClamAV debug: Subsystem: Win32 console
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Sat Jul 26, 2008 4:18 pm Reply with quote
are you sure you are using clamscan.exe from clamscan.7z file?
I'm almost sure I've added check for error 3 in this build
View user's profileSend private message
hard working ??
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Tue Jul 29, 2008 8:44 am Reply with quote
yes, i'm sure i use the clamscan.exe from the 7z package .
the strange thing is that the problem "....\keyhook.dll No such file or directory " still here .
but the file "....\array30ex.exe" seems good .

Embarassed
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Tue Jul 29, 2008 11:24 pm Reply with quote
the problem should be solved in last development version, I'll make a new binary build or maybe wait for next rc, are you already in the beta testing group?
View user's profileSend private message
thanks !
virtuemood


Joined: 16 Jul 2008
Posts: 0
Post Posted: Wed Jul 30, 2008 10:18 am Reply with quote
Clamwin is my favorite virus scanner .
I often use it to scan my computer memory before i use computer .

I am interesting in the beta testing work.
This is the first time I report a problem.

I am not in the team now.
I really want to join it.
I think I still need to learn how to be a good bug reporter.

====== About me - Just a student
Taiwan Tanini First Senior High School (TNFSH)
Computer & Information Study Club (TFCIS)
View user's profileSend private message
sherpya


Joined: 22 Mar 2006
Posts: 0
Location: Italy
Post Posted: Thu Jul 31, 2008 9:15 am Reply with quote
you are now in the beta testers group, alch will make a new rc when a problem with the scheduler is fixed
View user's profileSend private message
clamwin fail to scan files in some special directories.
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
 		All times are GMT  
Page 1 of 1  
  
  
ClamWin Free Antivirus Forum Index » Virus Scanner
 Reply to topic