Hi there,
Just some thoughts, as you asked. Sorry is isn't more helpful.
On Mon, 19 Oct 2020, iulian stan via clamav-users wrote:
#cat bla.gdb
S1:F:dd014af5ed6b38d9130e3f466f850e46d21b951199d53a18ef29ee9341614eaf
S1:P:dd014af5
Creating file to be tested:
#cat /tmp/clam.txt
http://www.google.com/
www.google.com
http://www.google.com/asdasdasd
I repeated your tests with 0.103-rc2 and got the same results. I
looked for obvious things like line terminators being included by
accident, but I didn't find anything.
Running scanner:
clamscan --debug -d bla.gdb /tmp/clam.txt
LibClamAV debug: Module <....> On
I wondered if there's a module that should be being loaded and isn't.
LibClamAV debug: Recognized ASCII text
I wondered does it need to recognize the file as HTML, and also if
there's some length limit below which the scanner won't bother doing
the scan (I've seen mention of something like that when I've been
reading the code looking for something else) but I tried wrapping your
text in some html tags, and added some padding, and it made no
difference. This is incidentally one of those cases where the values
printed in the output for "Data scanned" and "Data read" could be more
useful...
8<----------------------------------------------------------------------
...
LibClamAV debug: Recognized ASCII text
LibClamAV debug: Matched signature for file type HTML data at 0
...
----------- SCAN SUMMARY -----------
Known viruses: 2
Engine version: 0.103.0-rc2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.20 MB
Data read: 0.10 MB (ratio 2.00:1)
8<----------------------------------------------------------------------
Lastly
----------- SCAN SUMMARY -----------
Known viruses: 2
This doesn't seem right to me. There's really only one signature.
Basically I haven't seen anything here which might make me think the
problem is you, but I don't use the safebrowsing stuff so I don't have
the experience (and I don't have the time right now) to investigate it
further. It seems to me that even if there isn't something wrong with
clamd (which I guess means that it's faulty documentation) it really
shouldn't be this difficult - that alone would make it worth a report
to the ClamAV Bugzilla.
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
