Hi,
I have a fedora15 x86_64 box with clamav-0.97.2, postfix-2.8.4, and
amavisd-new-2.6.6 with spamassassin-3.3.2 that has been running fine
for quite a while. Recently, clamd has died with an error similar to
this:
Oct 10 02:55:56 mail02 amavis[25696]: (25696-18) (!)run_av
(ClamAV-clamscan) FAILED - unexpected exit 2, output="LibClamAV
Error:cli_hex2str(): Malformed hexstring: 22|20 (length: 5)\nLibClamAV
Error: cli_parse_add(): Problem adding signature (3).\nLibClamAV
Error: Problem parsing database at line 40734\nLibClamAV Error: Can't
load /var/lib/clamav/INetMsg-SpamDomains-2w.ndb: Malformed
database\nERROR: Malformed database"
Oct 10 02:55:56 mail02 amavis[25696]: (25696-18) (!)ClamAV-clamscan
av-scanner FAILED: /usr/bin/clamscan unexpected exit 2,
output="LibClamAV Error: cli_hex2str(): Malformed hexstring: 22|20
(length: 5)\nLibClamAV Error: cli_parse_add(): Problem adding
signature (3).\nLibClamAV Error: Problem parsing database at line
40734\nLibClamAV Error: Can't load
/var/lib/clamav/INetMsg-SpamDomains-2w.ndb: Malformed database\nERROR:
Malformed database" at (eval 91) line 596.
Is this a corrupt database? I'm using the clamav-unofficial-sigs
script to verify the updates and it hasn't reported a problem.
Restarting clamd apparently resolves the issue temporarily.
It has failed two or three times now over the course of about five
days, so it generally works properly.
The content of INetMsg-SpamDomains-2w.ndb at line 40734 is:
INetMsg.SpamDomain-2w.lakecharmvila_com:4:*:(2e|2f|40|20|3c|5f)6c616b65636861726d76696c612e636f6d(27|22|20|2f|3d|5f|3e|0a|0d)
# md5sum INetMsg-SpamDomains-2w.ndb
06d95496ef6e60fdee63dcf431c06b48 INetMsg-SpamDomains-2w.ndb
# sigtool --find-sigs INetMsg.SpamDomain-2w.lakecharmvila_com |
sigtool --decode-sigs
VIRUS NAME: INetMsg.SpamDomain-2w.lakecharmvila_com
TARGET TYPE: MAIL
OFFSET: *
DECODED SIGNATURE:
{CHAR_ALTERNATIVE:.|/|@| |<|_}lakecharmvila.com{CHAR_ALTERNATIVE:'|"| |/|=|_|>|
}
Thanks for any ideas.
Alex
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
