Clamav 0 103 0

Author: d | 2025-04-24

$ ./imaptest pass=testpass host=127.0.0.1 mbox=testmbox profile=pop3-profile.conf clients=100 secs=20 Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo LMTP 99 0 0 99 0 191 0 0 191 0 99 99 0/ 0 [99%] Warning: LMTP: Reached 175 connections, throttling 107 0 0 107 0 261 0 0 254 0 107 276 0/ 0 103 0 0 103 0 243 0 0 243 0 103 336 0/ 0 103 0 0 103 0 78 0 0 78 0 103 348 0/

Mailing List Archive: [clamav-users] ClamAV blog: ClamAV 0.

Send byte stream across machine boundaries. // Receive byte stream from beyond machine boundaries. Console.WriteLine(BitConverter.ToString(bytes)); if (BitConverter.IsLittleEndian) Array.Reverse(bytes); Console.WriteLine(BitConverter.ToString(bytes)); int result = BitConverter.ToInt32(bytes, 0); Console.WriteLine("Original value: {0}", value); Console.WriteLine("Returned value: {0}", result); }}// The example displays the following output on a little-endian system:// 4E-61-BC-00// 00-BC-61-4E// 00-BC-61-4E// 4E-61-BC-00// Original value: 12345678// Returned value: 12345678Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get response CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 13:53 RvdH wrote: 2022-02-10 09:36Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get responseHmm... Something's fishy...ClamAV log:Code: Select allThu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Thu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Code change...Code: Select all VirusScanningResult ClamAVVirusScanner::Scan(const String &hostName, int primaryPort, const String &sFilename) { LOG_DEBUG("Connecting to ClamAV virus scanner..."); int streamPort = 0; TimeoutCalculator calculator; SynchronousConnection commandConnection(calculator.Calculate(IniFileSettings::Instance()->GetClamMinTimeout(), IniFileSettings::Instance()->GetClamMaxTimeout())); if (!commandConnection.Connect(hostName, primaryPort)) { return VirusScanningResult(_T("ClamAVVirusScanner::Scan"), Formatter::Format("Unable to connect to ClamAV server at {0}:{1}.", hostName, primaryPort)); } if (!commandConnection.Write("nINSTREAM\n")) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write STREAM command."); AnsiString readData; // Send the file on the stream socket. File oFile; if (!oFile.Open(sFilename, File::OTReadOnly)) { String sErrorMsg = Formatter::Format("Could not send file {0} via socket since it

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 7 6 0 0 0 0 0 0 0 0 0 0 6 3 0 0

Returned value: 12345678Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get response CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6414 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 13:53 RvdH wrote: 2022-02-10 09:36Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get responseHmm... Something's fishy...ClamAV log:Code: Select allThu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Thu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Code change...Code: Select all VirusScanningResult ClamAVVirusScanner::Scan(const String &hostName, int primaryPort, const String &sFilename) { LOG_DEBUG("Connecting to ClamAV virus scanner..."); int streamPort = 0; TimeoutCalculator calculator; SynchronousConnection commandConnection(calculator.Calculate(IniFileSettings::Instance()->GetClamMinTimeout(), IniFileSettings::Instance()->GetClamMaxTimeout())); if (!commandConnection.Connect(hostName, primaryPort)) { return VirusScanningResult(_T("ClamAVVirusScanner::Scan"), Formatter::Format("Unable to connect to ClamAV server at {0}:{1}.", hostName, primaryPort)); } if (!commandConnection.Write("nINSTREAM\n")) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write STREAM command."); AnsiString readData; // Send the file on the stream socket. File oFile; if (!oFile.Open(sFilename, File::OTReadOnly)) { String sErrorMsg = Formatter::Format("Could not send file {0} via socket since it does not exist.", sFilename); return VirusScanningResult("ClamAVVirusScanner::Scan", sErrorMsg); } const int STREAM_BLOCK_SIZE = 4096; const int maxIterations = 100000; for (int i = 0; i pBuf = oFile.ReadChunk(STREAM_BLOCK_SIZE); if (!pBuf) break; // Send the request. if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.Write(*pBuf)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); } if (!commandConnection.Write(to_string(htonl(0)))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.ReadUntil("\n", readData)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to read response (after streaming)."); readData.TrimRight("\n"); // Parse the response and see if a virus was reported. try { const regex expression("^stream.*: (.*) FOUND$"); cmatch what;

Bug : clamav 0.102.2dfsg-0~deb9u1 flagged for

Does not exist.", sFilename); return VirusScanningResult("ClamAVVirusScanner::Scan", sErrorMsg); } const int STREAM_BLOCK_SIZE = 4096; const int maxIterations = 100000; for (int i = 0; i pBuf = oFile.ReadChunk(STREAM_BLOCK_SIZE); if (!pBuf) break; // Send the request. if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.Write(*pBuf)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); } if (!commandConnection.Write(to_string(htonl(0)))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.ReadUntil("\n", readData)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to read response (after streaming)."); readData.TrimRight("\n"); // Parse the response and see if a virus was reported. try { const regex expression("^stream.*: (.*) FOUND$"); cmatch what; if(regex_match(readData.c_str(), what, expression)) { LOG_DEBUG("Virus detected: " + what[1]); return VirusScanningResult(VirusScanningResult::VirusFound, String(what[1])); } else { LOG_DEBUG("No virus detected: " + readData); return VirusScanningResult(VirusScanningResult::NoVirusFound, Formatter::Format("Result: {0}", readData)); } } catch (std::runtime_error &) // regex_match will throw runtime_error if regexp is too complex. { return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to parse regular expression."); } }This is very wrong or only a little wrong ?;-)if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) Attachments SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3650 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:05 What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf))))); CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:17 RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ?? SørenR.Woke is Marxism advancing through Maoist cultural revolution. SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:30 Hmm....Code: Select all"DEBUG" 4020 "2022-02-10 13:28:39.698" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.701". $ ./imaptest pass=testpass host=127.0.0.1 mbox=testmbox profile=pop3-profile.conf clients=100 secs=20 Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo LMTP 99 0 0 99 0 191 0 0 191 0 99 99 0/ 0 [99%] Warning: LMTP: Reached 175 connections, throttling 107 0 0 107 0 261 0 0 254 0 107 276 0/ 0 103 0 0 103 0 243 0 0 243 0 103 336 0/ 0 103 0 0 103 0 78 0 0 78 0 103 348 0/

SiSoftware Sandra : 0 0 0 0 0 0 0 0

Trying to figure out the Perl pack function ... INSTREAMIt is mandatory to prefix this command with n or z.Scan a stream of data. The stream is sent to clamd in chunks, after INSTREAM, on the same socket on which the command was sent. This avoids the overhead of establishing new TCP connections and problems with NAT. The format of the chunk is: '' where is the size of the following data in bytes expressed as a 4 byte unsigned integer in network byte order and is the actual chunk. Streaming is terminated by sending a zero-length chunk. Note: do not exceed StreamMaxLength as defined in clamd.conf, otherwise clamd will reply with INSTREAM size limit exceeded and close the connection.NB. This is C#...Code: Select allusing System;public class Example{ public static void Main() { int value = 12345678; byte[] bytes = BitConverter.GetBytes(value); Console.WriteLine(BitConverter.ToString(bytes)); if (BitConverter.IsLittleEndian) Array.Reverse(bytes); Console.WriteLine(BitConverter.ToString(bytes)); // Call method to send byte stream across machine boundaries. // Receive byte stream from beyond machine boundaries. Console.WriteLine(BitConverter.ToString(bytes)); if (BitConverter.IsLittleEndian) Array.Reverse(bytes); Console.WriteLine(BitConverter.ToString(bytes)); int result = BitConverter.ToInt32(bytes, 0); Console.WriteLine("Original value: {0}", value); Console.WriteLine("Returned value: {0}", result); }}// The example displays the following output on a little-endian system:// 4E-61-BC-00// 00-BC-61-4E// 00-BC-61-4E// 4E-61-BC-00// Original value: 12345678// Returned value: 12345678Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get response CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 13:53 RvdH wrote: 2022-02-10 09:36Here is a complete clamav client wrapper written in C# ... #L238-L294htonl is the equivalent for "network-byte-order" in c++ as it seemsYou use either (newline escaped/delimited)or (zero escaped/delimited)workflow:1. send the INSTREAM command: zINSTREAM\0, or nINSTREAM\n2. send (big endian, 4 bytes)3. send the chunk of data corresponding to the above length4. repeat at 2 as long as you have more blocks to send5. send a 0-length block to mark end of stream6. get responseHmm... Something's fishy...ClamAV log:Code: Select allThu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Thu Feb 10 12:40:20 2022 -> WARNING: INSTREAM: Size limit reached, (requested: 842019123, max: 26214400)Code change...Code: Select all VirusScanningResult ClamAVVirusScanner::Scan(const String &hostName, int primaryPort, const String &sFilename) { LOG_DEBUG("Connecting to ClamAV virus scanner..."); int streamPort = 0; TimeoutCalculator calculator; SynchronousConnection commandConnection(calculator.Calculate(IniFileSettings::Instance()->GetClamMinTimeout(), IniFileSettings::Instance()->GetClamMaxTimeout())); if (!commandConnection.Connect(hostName, primaryPort)) { return VirusScanningResult(_T("ClamAVVirusScanner::Scan"), Formatter::Format("Unable to connect to ClamAV server at {0}:{1}.", hostName, primaryPort)); } if (!commandConnection.Write("nINSTREAM\n")) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write STREAM command."); AnsiString readData; // Send the file on the stream socket. File oFile; if (!oFile.Open(sFilename, File::OTReadOnly)) { String sErrorMsg = Formatter::Format("Could not send file {0} via socket since it

SILKYPIX Developer Studio Pro 6 0 0 0 0 0 0 0 0 0 0 0

"big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.719" "No virus detected: INSTREAM size limit exceeded. ERROR""DEBUG" 4020 "2022-02-10 13:28:39.723" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.725" "big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.751" "No virus detected: INSTREAM size limit exceeded. ERROR" SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3650 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:30 SorenR wrote: 2022-02-10 14:17RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ??Would the problem not be to_string()? CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:49 RvdH wrote: 2022-02-10 14:30SorenR wrote: 2022-02-10 14:17RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ??Would the problem not be to_string()?I think I'm mixing apples and pears... LOG_DEBUG("size of *pBuf " + to_string(sizeof(pBuf)));Code: Select all"DEBUG" 2916 "2022-02-10 13:38:28.703" "size of *pBuf 12"Code: Select allconst int STREAM_BLOCK_SIZE = 4096;std::shared_ptr pBuf = oFile.ReadChunk(STREAM_BLOCK_SIZE); SørenR.Woke is Marxism advancing through Maoist cultural revolution. jemm971 New user Posts: 5 Joined: 2020-10-07 23:15 Re: BUG: ClamAV 0.104.0 does not work Post by jemm971 » 2022-02-18 20:40 I have the same trouble since my upgrade of clamAV in the 0.104.2.0 version : I get a UNKNOWN RESPOND when I make a test of ClamAV in hMailServer.So I also upgrated to the last hMailServer version (5.6. , but still the same trouble.Finally I came back to my previous ClamAV version (0.102.2.0), which was working well. But in this version the freshclam doesn't

SILKYPIX Developer Studio Pro 7 0 0 0 0 0 0 0 0 0 0 0

Does not exist.", sFilename); return VirusScanningResult("ClamAVVirusScanner::Scan", sErrorMsg); } const int STREAM_BLOCK_SIZE = 4096; const int maxIterations = 100000; for (int i = 0; i pBuf = oFile.ReadChunk(STREAM_BLOCK_SIZE); if (!pBuf) break; // Send the request. if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.Write(*pBuf)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); } if (!commandConnection.Write(to_string(htonl(0)))) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to write data to stream port."); if (!commandConnection.ReadUntil("\n", readData)) return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to read response (after streaming)."); readData.TrimRight("\n"); // Parse the response and see if a virus was reported. try { const regex expression("^stream.*: (.*) FOUND$"); cmatch what; if(regex_match(readData.c_str(), what, expression)) { LOG_DEBUG("Virus detected: " + what[1]); return VirusScanningResult(VirusScanningResult::VirusFound, String(what[1])); } else { LOG_DEBUG("No virus detected: " + readData); return VirusScanningResult(VirusScanningResult::NoVirusFound, Formatter::Format("Result: {0}", readData)); } } catch (std::runtime_error &) // regex_match will throw runtime_error if regexp is too complex. { return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to parse regular expression."); } }This is very wrong or only a little wrong ?;-)if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) Attachments SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3650 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:05 What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf))))); CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:17 RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ?? SørenR.Woke is Marxism advancing through Maoist cultural revolution. SorenR Senior user Posts: 6413 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:30 Hmm....Code: Select all"DEBUG" 4020 "2022-02-10 13:28:39.698" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.701" "big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.719" "No virus detected: INSTREAM size limit exceeded. ERROR""DEBUG" 4020 "2022-02-10 13:28:39.723" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.725" "big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.751" "No virus detected: INSTREAM size limit exceeded. ERROR" SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3650 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:30 SorenR wrote: 2022-02-10 14:17RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ??Would the problem not be to_string()? CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6413

XAMPP -0 / -0 / -0 / -0 / -0

--------------------------------------freshclam daemon 1.0.6 (OS: Linux, ARCH: x86_64, CPU: x86_64)ClamAV update process started at Wed Nov 13 22:58:39 2024daily database available for update (local version: 26951, remote version: 27457)WARNING: downloadFile: file not found: downloadPatch: Can't download daily-26952.cdiff from downloadFile: file not found: downloadPatch: Can't download daily-26952.cdiff from downloadFile: file not found: downloadPatch: Can't download daily-26952.cdiff from Incremental update failed, trying to download daily.cvdTesting database: '/opt/zimbra/data/clamav/db/tmp.c6c4bde2c0/clamav-71471ba8e88d7cef2c3289b824b9a580.tmp-daily.cvd' ...Database test passed.daily.cvd updated (version: 27457, sigs: 2067892, f-level: 90, builder: raynman)main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)bytecode database available for update (local version: 334, remote version: 335)Testing database: '/opt/zimbra/data/clamav/db/tmp.c6c4bde2c0/clamav-186b71904808f37c645f8065a09869ff.tmp-bytecode.cld' ...Database test passed.bytecode.cld updated (version: 335, sigs: 86, f-level: 90, builder: raynman)Clamd successfully notified about the update. GET /daily-26952.cdiff HTTP/2> Host: database.clamav.net> User-Agent: curl/7.61.1> Accept: */*>* TLSv1.3 (IN), TLS handshake, [no content] (0):* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):* TLSv1.3 (IN), TLS app data, [no content] (0):* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!* TLSv1.3 (OUT), TLS app data, [no content] (0):* TLSv1.3 (IN), TLS app data, [no content] (0): Attention Required! | Cloudflarebody{margin:0;padding:0} if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } Please enable cookies.* TLSv1.3 (IN), TLS app data, [no content] (0): Sorry, you have been blocked You are unable to access clamav.net Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data. What can I do to resolve this?* TLSv1.3 (IN), TLS app data, [no content] (0): You can email the site owner to let them know you were blocked. Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page. Cloudflare Ray ID: 8e22827bda1f94b7 • Your IP: Click to reveal 88.97.91.208 • Performance & security by Cloudflare * TLSv1.3 (IN), TLS app data, [no content] (0): (function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})(); window._cf_translation = {};* TLSv1.3 (IN), TLS app data, [no content] (0):* Connection #0 to host database.clamav.net left intact">curl -v Trying 104.16.219.84...* TCP_NODELAY set* Connected to database.clamav.net (104.16.219.84) port 443 (#0)* ALPN, offering h2* ALPN, offering http/1.1* successfully set certificate verify locations:* CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none* TLSv1.3 (OUT), TLS handshake, Client hello (1):* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.3 (IN), TLS handshake, [no content] (0):* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):* TLSv1.3 (IN), TLS handshake, Certificate (11):* TLSv1.3 (IN), TLS handshake, CERT verify (15):* TLSv1.3 (IN), TLS handshake, Finished (20):* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):* TLSv1.3 (OUT), TLS handshake, [no content] (0):* TLSv1.3 (OUT), TLS handshake, Finished (20):* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384* ALPN, server accepted to use h2* Server certificate:* subject: CN=database.clamav.net* start date: Oct 8 10:45:45 2024 GMT* expire date: Jan 6 10:45:44 2025 GMT* subjectAltName: host "database.clamav.net" matched cert's "database.clamav.net"* issuer:. $ ./imaptest pass=testpass host=127.0.0.1 mbox=testmbox profile=pop3-profile.conf clients=100 secs=20 Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo LMTP 99 0 0 99 0 191 0 0 191 0 99 99 0/ 0 [99%] Warning: LMTP: Reached 175 connections, throttling 107 0 0 107 0 261 0 0 254 0 107 276 0/ 0 103 0 0 103 0 243 0 0 243 0 103 336 0/ 0 103 0 0 103 0 78 0 0 78 0 103 348 0/ Clamav Clamav version 1.0.0 security vulnerabilities, CVEs, exploits, vulnerability statistics, CVSS scores and references 1 0 0 1 0 2025: 0 0 0 1 0 Total 1 2 This page lists vulnerability statistics for CVEs published in the last ten years, if any, for Clamav Clamav 1.0.0 . Vulnerability statistics provide a

XAMPP -0 / -0 / -0 / -0 /

If(regex_match(readData.c_str(), what, expression)) { LOG_DEBUG("Virus detected: " + what[1]); return VirusScanningResult(VirusScanningResult::VirusFound, String(what[1])); } else { LOG_DEBUG("No virus detected: " + readData); return VirusScanningResult(VirusScanningResult::NoVirusFound, Formatter::Format("Result: {0}", readData)); } } catch (std::runtime_error &) // regex_match will throw runtime_error if regexp is too complex. { return VirusScanningResult("ClamAVVirusScanner::Scan", "Unable to parse regular expression."); } }This is very wrong or only a little wrong ?;-)if (!commandConnection.Write(to_string(htonl(sizeof(*pBuf))))) Attachments SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3657 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:05 What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf))))); CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6414 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:17 RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ?? SørenR.Woke is Marxism advancing through Maoist cultural revolution. SorenR Senior user Posts: 6414 Joined: 2006-08-21 15:38 Location: Denmark Re: BUG: ClamAV 0.104.0 does not work Post by SorenR » 2022-02-10 14:30 Hmm....Code: Select all"DEBUG" 4020 "2022-02-10 13:28:39.698" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.701" "big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.719" "No virus detected: INSTREAM size limit exceeded. ERROR""DEBUG" 4020 "2022-02-10 13:28:39.723" "Connecting to ClamAV virus scanner...""DEBUG" 4020 "2022-02-10 13:28:39.725" "big endian, 4 bytes: {0} 201326592""DEBUG" 4020 "2022-02-10 13:28:39.751" "No virus detected: INSTREAM size limit exceeded. ERROR" SørenR.Woke is Marxism advancing through Maoist cultural revolution. RvdH Senior user Posts: 3657 Joined: 2008-06-27 14:42 Location: The Netherlands Re: BUG: ClamAV 0.104.0 does not work Post by RvdH » 2022-02-10 14:30 SorenR wrote: 2022-02-10 14:17RvdH wrote: 2022-02-10 14:05What if you LOG_DEBUG that value? Just the check if it holds proper values...not behind my PC right now, so can not checkLOG_DEBUG(Formatter::Format("big endian, 4 bytes: {0}", to_string(htonl(sizeof(*pBuf)))));Chunk size is 4096 (int), 4096 in hex is "0x1000" and Big Endian should be "0x0001" No ??Would the problem not be to_string()? CIDR to RegEx: d-fault.nl/cidrtoregexDNS Lookup: d-fault.nl/dnstoolsDKIM Generator: d-fault.nl/dkimgeneratorDNSBL Lookup: d-fault.nl/dnsbllookupGEOIP Lookup: d-fault.nl/geoiplookup SorenR Senior user Posts: 6414

Mailing List Archive: [clamav-users] ClamAV blog: ClamAV 0.

0x14// 103 --> 0x147// 255 --> 0x377// Base 10 conversion:// 0 --> 0x0// 12 --> 0x12// 103 --> 0x103// 255 --> 0x255// Base 16 conversion:// 0 --> 0x0// 12 --> 0xc// 103 --> 0x67// 255 --> 0xfflet bases = [| 2; 8; 10; 16 |]let numbers = [| Byte.MinValue; 12uy; 103uy; Byte.MaxValue |]for baseValue in bases do printfn $"Base {baseValue} conversion:" for number in numbers do Console.WriteLine(" {0,-5} --> 0x{1}", number, Convert.ToString(number, baseValue))// The example displays the following output:// Base 2 conversion:// 0 --> 0x0// 12 --> 0x1100// 103 --> 0x1100111// 255 --> 0x11111111// Base 8 conversion:// 0 --> 0x0// 12 --> 0x14// 103 --> 0x147// 255 --> 0x377// Base 10 conversion:// 0 --> 0x0// 12 --> 0x12// 103 --> 0x103// 255 --> 0x255// Base 16 conversion:// 0 --> 0x0// 12 --> 0xc// 103 --> 0x67// 255 --> 0xffDim bases() As Integer = { 2, 8, 10, 16}Dim numbers() As Byte = { Byte.MinValue, 12, 103, Byte.MaxValue}For Each base As Integer In bases Console.WriteLine("Base {0} conversion:", base) For Each number As Byte In numbers Console.WriteLine(" {0,-5} --> 0x{1}", _ number, Convert.ToString(number, base)) NextNext' The example displays the following output:' Base 2 conversion:' 0 --> 0x0' 12 --> 0x1100' 103 --> 0x1100111' 255 --> 0x11111111' Base 8 conversion:' 0 --> 0x0' 12 --> 0x14' 103 --> 0x147' 255 --> 0x377' Base 10 conversion:' 0 --> 0x0' 12 --> 0x12' 103 --> 0x103' 255 --> 0x255' Base 16 conversion:' 0 --> 0x0' 12 --> 0xc' 103 --> 0x67' 255 --> 0xfflet bases = [2; 8; 10; 16]let numbers = [ Byte.MinValue; 12uy; 103uy; Byte.MaxValue ]for baseValue in bases do printfn "Base %i conversion:" baseValue for number in numbers do printfn " % -5i --> 0x%s" number (Convert.ToString (number, baseValue))// The example displays the following output:// Base 2 conversion:// 0 --> 0x0// 12 --> 0x1100// 103 --> 0x1100111// 255 --> 0x11111111// Base 8 conversion:// 0 --> 0x0// 12 --> 0x14// 103 --> 0x147// 255 --> 0x377// Base 10 conversion:// 0 --> 0x0// 12 --> 0x12// 103 --> 0x103// 255 --> 0x255// Base 16 conversion:// 0 --> 0x0// 12 --> 0xc// 103 --> 0x67// 255 --> 0xff Remarks If toBase does not equal 10, the string that is returned by the Convert.ToString(Byte, Int32) method represents value by its magnitude only. If the method is called to create a string that will later be converted back to a number, a corresponding method that assumes a magnitude-only numeric representation should be called to perform the conversion. Such methods include Convert.ToByte(String, Int32) or Byte.Parse(String, NumberStyles). Applies to ToString(Boolean, IFormatProvider) Source:Convert.cs Source:Convert.cs Source:Convert.cs Converts the specified Boolean value to its equivalent string representation. public: static System::String ^ ToString(bool value, IFormatProvider ^ provider); public static string ToString(bool value, IFormatProvider. $ ./imaptest pass=testpass host=127.0.0.1 mbox=testmbox profile=pop3-profile.conf clients=100 secs=20 Logi List Stat Sele Fetc Fet2 Stor Dele Expu Appe Logo LMTP 99 0 0 99 0 191 0 0 191 0 99 99 0/ 0 [99%] Warning: LMTP: Reached 175 connections, throttling 107 0 0 107 0 261 0 0 254 0 107 276 0/ 0 103 0 0 103 0 243 0 0 243 0 103 336 0/ 0 103 0 0 103 0 78 0 0 78 0 103 348 0/ Clamav Clamav version 1.0.0 security vulnerabilities, CVEs, exploits, vulnerability statistics, CVSS scores and references 1 0 0 1 0 2025: 0 0 0 1 0 Total 1 2 This page lists vulnerability statistics for CVEs published in the last ten years, if any, for Clamav Clamav 1.0.0 . Vulnerability statistics provide a

0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 7 6 0 0 0 0 0 0 0 0 0 0 6 3 0 0

I have the latest version of freshclam and clamav installed, and in the past (when I had Ubuntu 14.10) it has only run freshclam automatically a few times a day, but has not been running all the time. Now what I am finding though that if I go to Terminal and execute:sudo freshclamThat I get: ERROR: /var/log/clamav/freshclam.log is locked by another processERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).And then the only way to be able to manually run that command is to kill the freshclam process, but this is time wasting, and annoying, so I would like to fully stop freshclam from auto updating, so that I can do manual updates.So what I tried was to install clamtk, and in the Update Assistant settings I tried to set it so that I would manually install updates, and then I clicked Apply, but this seemed, even after a restart, to have no impact on how freshclam behaved.So really my question is, how can I get it so that freshclam does not automatically check for updates, or at least for it to do it a few times a day, but not always be there so that I have to kill it to run it? Or is there a way to fix clamtk so that it does it properly (I have got in touch with the developer of clamtk and he is looking into it, but does not know what the issue is)?OS Information:Description: Ubuntu 15.04Release: 15.04Package Information:ClamTk:clamtk: Installed: 5.18-1 Candidate: 5.18-1 Version table: *** 5.18-1 0 100 /var/lib/dpkg/status 5.15-1 0 500 vivid/universe amd64 PackagesClamAV:clamav: Installed: 0.98.7+dfsg-0ubuntu0.15.04.1 Candidate: 0.98.7+dfsg-0ubuntu0.15.04.1 Version table: *** 0.98.7+dfsg-0ubuntu0.15.04.1 0 500 vivid-updates/main amd64 Packages 500 vivid-security/main amd64 Packages 100 /var/lib/dpkg/status 0.98.6+dfsg-1ubuntu2 0 500 vivid/main amd64 Packages