Trog wrote:
On Tue, 2005-07-19 at 14:37 +0200, Marco Steinacher wrote:
Yesterday our mailserver could not forward a message because clamav got
stuck with a heavy cpu load while scanning it. It seems that the
attachement (powerpoint file) causes clamav to hang with a high cpu usage.
Unfortunately I cannot provide the concerning file because it is
confidential. Therefore I would like to ask you, what I should do to
find that possible bug. What is the usual debugging procedure in such a
case and which information should I provide you to find/fix the bug.
Send the output of 'clamscan --debug <filename>'
OK, thanks. Below you'll find the debug output. The part "Recognized
OLE2 container file ... Calculated MD5 checksum ..." is repeated
infinitely (or at least too long for a 3MB file). The calculation ot the
MD5 checksums is very fast for some of them but very slow for others and
put a huge load on the machine.
Any ideas what the problem might be?
Thanks.
Marco
LibClamAV debug: Loading databases from /usr/local/share/clamav
LibClamAV debug: Loading /usr/local/share/clamav/main.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = 7c497735a7e1a3e15dde75832bef48f3
LibClamAV debug: Decoded signature: 7c497735a7e1a3e15dde75832bef48f3
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/COPYING
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/main.db
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/main.hdb
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/main.ndb
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/main.zmd
LibClamAV debug: Unpacking /tmp/clamav-86512da97c5f160e/main.fp
LibClamAV debug: Loading databases from /tmp/clamav-86512da97c5f160e
LibClamAV debug: Loading /tmp/clamav-86512da97c5f160e/main.db
LibClamAV debug: Initializing main node
LibClamAV debug: Initializing trie
LibClamAV debug: Initializing BM tables
LibClamAV debug: in cli_bm_init()
LibClamAV debug: BM: Number of indexes = 63744
LibClamAV debug: Loading /tmp/clamav-86512da97c5f160e/main.hdb
LibClamAV debug: Initializing md5 list structure
LibClamAV debug: Loading /tmp/clamav-86512da97c5f160e/main.ndb
LibClamAV debug: Loading /tmp/clamav-86512da97c5f160e/main.zmd
LibClamAV debug: Loading /tmp/clamav-86512da97c5f160e/main.fp
LibClamAV debug: Loading /usr/local/share/clamav/daily.cvd
LibClamAV debug: in cli_cvdload()
LibClamAV debug: MD5(.tar.gz) = df80bc7c18d325ed710c110d4a5a045b
LibClamAV debug: Decoded signature: df80bc7c18d325ed710c110d4a5a045b
LibClamAV debug: Digital signature is correct.
LibClamAV debug: in cli_untgz()
LibClamAV debug: Unpacking /tmp/clamav-d34cbdcba006abe1/COPYING
LibClamAV debug: Unpacking /tmp/clamav-d34cbdcba006abe1/daily.db
LibClamAV debug: Unpacking /tmp/clamav-d34cbdcba006abe1/daily.hdb
LibClamAV debug: Unpacking /tmp/clamav-d34cbdcba006abe1/daily.ndb
LibClamAV debug: Loading databases from /tmp/clamav-d34cbdcba006abe1
LibClamAV debug: Loading /tmp/clamav-d34cbdcba006abe1/daily.db
LibClamAV debug: Loading /tmp/clamav-d34cbdcba006abe1/daily.hdb
LibClamAV debug: Loading /tmp/clamav-d34cbdcba006abe1/daily.ndb
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 48
LibClamAV debug: Prop start: 6109
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: -2
LibClamAV debug: SBat block count: 0
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: b LibClamAV debug: 0 0
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 21784 0
LibClamAV debug: Current User LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 4096 0
LibClamAV debug: Pictures LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 358372 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 4096 0
LibClamAV debug: PowerPoint Document LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 2714547 0
LibClamAV debug: VBADir: /tmp/clamav-e7e57ed793ffd474
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-e7e57ed793ffd474/_VBA_PROJECT
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03e8
LibClamAV debug: Length: 0x00003d63
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03f8
LibClamAV debug: Length: 0x00000952
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03f0
LibClamAV debug: Length: 0x0000064a
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x0fc9
LibClamAV debug: Length: 0x00000468
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000283d
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000350
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000003d5
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00003597
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000303
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000408
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000590c
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000879
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00001abb
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000008d7
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000009c8
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000a74
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000a78
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000ad3
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000008a8
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000854
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000007f5
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000007e1
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000008cd
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000753
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000007ae
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000736
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x000008c1
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000c89
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000cc6
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000b5e
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000912
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000269
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000269
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000269
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000269
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000344
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000027d
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x00000293
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03ee
LibClamAV debug: Length: 0x0000028f
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03f0
LibClamAV debug: Length: 0x000001e8
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03f0
LibClamAV debug: Length: 0x000001e8
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x0f
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x03f0
LibClamAV debug: Length: 0x000001e8
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x00031353
LibClamAV debug: OleID: 1419264, length: 201551
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x000502aa
LibClamAV debug: OleID: 3701760, length: 328358
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x00050899
LibClamAV debug: OleID: 3724288, length: 329877
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x00031352
LibClamAV debug: OleID: 1419264, length: 201550
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x000502aa
LibClamAV debug: OleID: 3701760, length: 328358
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x0005090a
LibClamAV debug: OleID: 3724288, length: 329990
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x0003134e
LibClamAV debug: OleID: 1419264, length: 201546
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x000502aa
LibClamAV debug: OleID: 3701760, length: 328358
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0001
LibClamAV debug: Type: 0x1011
LibClamAV debug: Length: 0x00050927
LibClamAV debug: OleID: 3724288, length: 330019
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x1772
LibClamAV debug: Length: 0x0000010c
LibClamAV debug: Atom Hdr:
LibClamAV debug: Version: 0x00
LibClamAV debug: Instance: 0x0000
LibClamAV debug: Type: 0x0ff5
LibClamAV debug: Length: 0x0000001c
LibClamAV debug: read ppt_current_user failed
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 22
LibClamAV debug: Prop start: 2
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: 5
LibClamAV debug: SBat block count: 1
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: r LibClamAV debug: 896 0
LibClamAV debug: _1_CompObj LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 113 0
LibClamAV debug: _1_Ole LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 20 0
LibClamAV debug: VisioDocument LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 180735 0
LibClamAV debug: _2_OlePres000 LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 1161618 0
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 60996 0
LibClamAV debug: VisioInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 28 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 592 0
LibClamAV debug: VBADir: /tmp/clamav-3de69400ffa899b1
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-3de69400ffa899b1/_VBA_PROJECT
LibClamAV debug: Open PowerPoint Document failed
LibClamAV debug: Open WordDocument failed
LibClamAV debug: Calculated MD5 checksum: cd99013c25db82e4b8649a43c3e50ec9
LibClamAV debug: Calculated MD5 checksum: 8b8516166922a7d8a34c4e0fd94557de
LibClamAV debug: Matched signature for file type: HTML data
LibClamAV debug: Calculated MD5 checksum: 56139b38336bf3146170c708b3399eda
LibClamAV debug: in cli_scanhtml()
LibClamAV debug: mmap'ed file
LibClamAV debug: Calculated MD5 checksum: 01645b30e0bc5a8c7cec4cc91b6d6b14
LibClamAV debug: Calculated MD5 checksum: 01645b30e0bc5a8c7cec4cc91b6d6b14
LibClamAV debug: Calculated MD5 checksum: d41d8cd98f00b204e9800998ecf8427e
LibClamAV debug: Calculated MD5 checksum: e920dff2cce9f5a793c57991b5fe0c4e
LibClamAV debug: Calculated MD5 checksum: f672fcdef0e888da36bec957daa107f3
LibClamAV debug: Calculated MD5 checksum: 42ae7829957998cae9783f744db52166
LibClamAV debug: Calculated MD5 checksum: 2ae768aab3ad03788a770415c9e43958
LibClamAV debug: Calculated MD5 checksum: 406ae33ed8f8f85103b062ce498f3d94
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 57
LibClamAV debug: Prop start: 1
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: 2
LibClamAV debug: SBat block count: 1
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: r LibClamAV debug: 832 0
LibClamAV debug: _1_CompObj LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 113 0
LibClamAV debug: _1_Ole LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 20 0
LibClamAV debug: VisioDocument LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 537879 0
LibClamAV debug: _2_OlePres000 LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 3069896 0
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 60996 0
LibClamAV debug: ERROR: handler failed
LibClamAV debug: VisioInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 28 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 564 0
LibClamAV debug: ole2_get_sbat_data_block failed
LibClamAV debug: ERROR: handler failed
LibClamAV debug: VBADir: /tmp/clamav-757539ab000f6651
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-757539ab000f6651/_VBA_PROJECT
LibClamAV debug: Open PowerPoint Document failed
LibClamAV debug: Open WordDocument failed
LibClamAV debug: Calculated MD5 checksum: cd99013c25db82e4b8649a43c3e50ec9
LibClamAV debug: Calculated MD5 checksum: 8b8516166922a7d8a34c4e0fd94557de
LibClamAV debug: Calculated MD5 checksum: 4de545d4b4a85bba7165828e21d9df54
LibClamAV debug: Calculated MD5 checksum: a6389a8bc31eae727a00052e74074139
LibClamAV debug: Calculated MD5 checksum: 832a0cda0015eaf40099ac72c7099b66
LibClamAV debug: Calculated MD5 checksum: 42ae7829957998cae9783f744db52166
LibClamAV debug: Calculated MD5 checksum: 9506fa6eade1a58e76b2568fa8701c99
LibClamAV debug: Calculated MD5 checksum: 0f4a844aceee29cb62a473f83636d00f
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 57
LibClamAV debug: Prop start: 2
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: 5
LibClamAV debug: SBat block count: 1
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: r LibClamAV debug: 896 0
LibClamAV debug: _1_CompObj LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 113 0
LibClamAV debug: _1_Ole LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 20 0
LibClamAV debug: VisioDocument LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 541546 0
LibClamAV debug: _2_OlePres000 LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 3087502 0
LibClamAV debug: ERROR: handler failed
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 60996 0
LibClamAV debug: VisioInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 28 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 588 0
LibClamAV debug: VBADir: /tmp/clamav-15b615f26bb3be03
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-15b615f26bb3be03/_VBA_PROJECT
LibClamAV debug: Open PowerPoint Document failed
LibClamAV debug: Open WordDocument failed
LibClamAV debug: Calculated MD5 checksum: cd99013c25db82e4b8649a43c3e50ec9
LibClamAV debug: Calculated MD5 checksum: 8b8516166922a7d8a34c4e0fd94557de
LibClamAV debug: Calculated MD5 checksum: 5cd3947d5c414ef73e6a558f5f9657b9
LibClamAV debug: Calculated MD5 checksum: 59e28da57066866526dc73a6d32b32e3
LibClamAV debug: Calculated MD5 checksum: 97bae9775633c37fb05ea82d8ea35e34
LibClamAV debug: Calculated MD5 checksum: 42ae7829957998cae9783f744db52166
LibClamAV debug: Calculated MD5 checksum: ee96222129af611759483965fff9b701
LibClamAV debug: Calculated MD5 checksum: 9369f1d065b253896534e0e1257fa4d2
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 22
LibClamAV debug: Prop start: 2
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: 5
LibClamAV debug: SBat block count: 1
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: r LibClamAV debug: 896 0
LibClamAV debug: _1_CompObj LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 113 0
LibClamAV debug: _1_Ole LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 20 0
LibClamAV debug: VisioDocument LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 180735 0
LibClamAV debug: _2_OlePres000 LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 1161618 0
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 60996 0
LibClamAV debug: VisioInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 28 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 592 0
LibClamAV debug: VBADir: /tmp/clamav-f45af6e4b63a06f2
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-f45af6e4b63a06f2/_VBA_PROJECT
LibClamAV debug: Open PowerPoint Document failed
LibClamAV debug: Open WordDocument failed
LibClamAV debug: Calculated MD5 checksum: cd99013c25db82e4b8649a43c3e50ec9
LibClamAV debug: Calculated MD5 checksum: 8b8516166922a7d8a34c4e0fd94557de
LibClamAV debug: Matched signature for file type: HTML data
LibClamAV debug: Calculated MD5 checksum: 56139b38336bf3146170c708b3399eda
LibClamAV debug: in cli_scanhtml()
LibClamAV debug: mmap'ed file
LibClamAV debug: Calculated MD5 checksum: 01645b30e0bc5a8c7cec4cc91b6d6b14
LibClamAV debug: Calculated MD5 checksum: 01645b30e0bc5a8c7cec4cc91b6d6b14
LibClamAV debug: Calculated MD5 checksum: d41d8cd98f00b204e9800998ecf8427e
LibClamAV debug: Calculated MD5 checksum: e920dff2cce9f5a793c57991b5fe0c4e
LibClamAV debug: Calculated MD5 checksum: f672fcdef0e888da36bec957daa107f3
LibClamAV debug: Calculated MD5 checksum: 42ae7829957998cae9783f744db52166
LibClamAV debug: Calculated MD5 checksum: 2ae768aab3ad03788a770415c9e43958
LibClamAV debug: Calculated MD5 checksum: fb615a7cc8f542ac2b9b5062539c2b0c
LibClamAV debug: Recognized OLE2 container file
LibClamAV debug: in cli_scanole2()
LibClamAV debug: in cli_ole2_extract()
LibClamAV debug: mmap'ed file
LibClamAV debug:
Magic: 0xLibClamAV debug: d0LibClamAV debug: cfLibClamAV debug:
11LibClamAV debug: e0LibClamAV debug: a1LibClamAV debug: b1LibClamAV
debug: 1aLibClamAV debug: e1LibClamAV debug:
LibClamAV debug: CLSID: {LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV
debug: 0 LibClamAV debug: 0 LibClamAV debug: 0 LibClamAV debug: 0
LibClamAV debug: }
LibClamAV debug: Minor version: 0x3e
LibClamAV debug: DLL version: 0x3
LibClamAV debug: Byte Order: -2
LibClamAV debug: Big Block Size: 9
LibClamAV debug: Small Block Size: 6
LibClamAV debug: BAT count: 57
LibClamAV debug: Prop start: 1
LibClamAV debug: SBAT cutoff: 4096
LibClamAV debug: SBat start: 2
LibClamAV debug: SBat block count: 1
LibClamAV debug: XBat start: -2
LibClamAV debug: XBat block count: 0
LibClamAV debug: Root Entry LibClamAV debug:
[root] LibClamAV debug: r LibClamAV debug: 832 0
LibClamAV debug: _1_CompObj LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 113 0
LibClamAV debug: _1_Ole LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 20 0
LibClamAV debug: VisioDocument LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 537879 0
LibClamAV debug: _2_OlePres000 LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 3069896 0
LibClamAV debug: _5_SummaryInformation LibClamAV debug:
[file] LibClamAV debug: b LibClamAV debug: 60996 0
LibClamAV debug: ERROR: handler failed
LibClamAV debug: VisioInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 28 0
LibClamAV debug: _5_DocumentSummaryInformation LibClamAV debug:
[file] LibClamAV debug: r LibClamAV debug: 564 0
LibClamAV debug: ole2_get_sbat_data_block failed
LibClamAV debug: ERROR: handler failed
LibClamAV debug: VBADir: /tmp/clamav-c0c92683a0048783
LibClamAV debug: in vba56_dir_read()
LibClamAV debug: Can't open /tmp/clamav-c0c92683a0048783/_VBA_PROJECT
LibClamAV debug: Open PowerPoint Document failed
LibClamAV debug: Open WordDocument failed
LibClamAV debug: Calculated MD5 checksum: cd99013c25db82e4b8649a43c3e50ec9
LibClamAV debug: Calculated MD5 checksum: 8b8516166922a7d8a34c4e0fd94557de
LibClamAV debug: Calculated MD5 checksum: 4de545d4b4a85bba7165828e21d9df54
[...]
--
WebSource Internet Services - www.websource.ch
Kontakt/PGP-Keys: www.websource.ch/kontakt
PGP: 0x0B431D6B - 0BCA FD08 2859 FF1A 4B42 29BD DD91 3A67 0B43 1D6B
Do NOT use this address: [EMAIL PROTECTED]
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
