I'm sure the developers will see this thread and address it. Meantime, you might increase your scan limit size to see what that does.

Regards,

More infomation and further test.

One of the error files, properties:


An individual scan of the files showing the error:



And yet, another file of similar properties, the only difference being the size and the scan shows no errors:





This suggests that it is size causing the problem and that the threshold of the problem begins above 1.11GB and under 1.4GB file sizes.

I hope the developers see this, find it interesting and can offer some resolve. Remeber, this was NOT a problem in v0.97 (and started only after upgrade to 0.98 )

Can you find any other files that you have that are inbetween 1.11gb and 1.4gb to confirm your issue? Also, have you tried some basic fixes, such as seeing if you still have the program for which those files came from (aka. could be dead files), and also have you tried a complete uninstall and reinstall of ClamWin to see if that did the trick?

Ok,....

There are 2x files that produce the ERRORs and they are both at the 1.4GB mark. The next largest file size down is the 1.11 (detailed above) and that doesnt error. There are no other files above this size. The only other files I have that are larger are ZIP archive files (at 8GB) but they are exempt from scanning normally but even an on-access scan of them doesnt error. (Zips are different though, arent they.)

They are all working m4v video files (films from iTunes downloads). There are other m4V's that are also smaller and they dont have a problem.

Yes I have uninstalled and reinstalled several times.

EDIT:

I did find a windows Index file at 2.0GB :

name: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ci
size: 2.09 GB (2,255,200,256 bytes)

Just did a manual scan on it and it seems to complete ok. I say "ok", it actually correctly didnt scan it because it was too big (according to my file size limit of 20MB in configuration). Note the "data scanned = 0.00". (I would expect the same from the above files because they equally are too big but still it complains).



So maybe we are talking about a combination of file type + size causing problems?

Reckon this could have done with reporting to ClamAV in case it is something in the original coding but....

ClamAV 'Report A Bug' page says:

I cant read 'git code' and Clamwin is a thirdparty software. I conclude this as that page continues to give advice on how to submit various system variables and they use all Linux commands such as kernel core dumps and (therefore no provision for equivalent windows commands).

Humph!!

I believe this error message should be suppressed (hidden) by the ClamWin developers in the future. Most viruses are in files that are less than 1 MB in size--they would be too visible in larger files.

Regards,

I think my discussion about this is more on a matter of principal rather than it causing a function or fundamental error. I say it because:

a, having log files saying ERRORS encountered in them can cause worry and unnecessary investigation (land the frequency of this could lead to possibly overlooking genuine errors that needs attention)
b, No developer wants random errors. And this is random. As said above:
i, it never happened in 0.97 -the cause of this was introduced in 0.98
ii, I have 'scan file size limit' set at 20mb so it should be ignoring these anyway
iii, other files that are stupidly large are not erroring the same way (therefore no reason is obvious)

So I dont think its a case of 'suppressing' or hiding the error in the log, more about fixing the cause of the error so it wouldnt be generated in the first place. After all, if there is an unexplained condition causing this error then how can we or the developers be sure that there arent other strange conditions that may well be more serious?

Actually, once long ago, before Cisco acquired Sourcefire, ClamAV and ClamWin use to be in close contact and helped each other out. ClamWin is actually just a Windows ported version of ClamAV with a simple GUI on top. Many users of ClamWin have reported errors to the ClamAV community in the past. I think you are OK to send this to ClamAV team.

I also will go ahead and send this to Alch, since .99 beta testing is still going on.

Most likely it is the internal processing of a video file that throws clamav engine off. We could investigate it if you made one of the files that triggers an error available for download.

Thanks,

Sure. Can you send me (email me) an email address (Im sure you have my registration details), and I will email you a link for you to download it.

Hi Alex, link emailed. Any more info required then do of course shout up.

Got it, thanks!

Clamav tries to "map" the entire file but it does not have enough contiguous memory, on demand scan on a single file ignores file limits

update: looks like clamav ignores the limit also scanning a directory

And does a schedule scan of, say, d: constitute 'scanning a folder'? Because that's when this error also happens. (If so when exactly is the file size limit actually adhered to? )

Also how was I able to successfully scan a .CI file of 2.2GB without the error and yet not the 1.4GB m4v file (both on demand)?

unfortunately the file size is checked after "mapping" the file, you currently cannot scan such a big file with the 32bit version of clamav, you need 64bit binaries,
alex what about adding also 64bit binaries to the installer? obviously you still need 32bit libclamav for pyc