CLAMAV error

CLAMAV error

by Eric Henson -
Number of replies: 12
Hello, I am getting error emails from CLAMAV when I upload files.

My email error is:
Clam AV has failed to run. The return error message was Database initialization error.. Here is the output from Clam:

ERROR: Can't initialize the virus database

----------- SCAN SUMMARY -----------
Known viruses: 0
Engine version: 0.88.7
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Time: 0.011 sec (0 m 0 s)

My Clam AV settings in Moodle are below
Use clam AV on uploaded files runclamonupload
CLAMAV Path: /usr/bin/clamscan
Quarantine Direcotry: empty
On CLAMAV Failure: Treat files as OK

Server environment
OS: openSUSE 10.2
Moodle 1.7+
CLAMAV service is started

Is there something that I am missing?

Thanks in advance

Average of ratings: -
In reply to Eric Henson

Re: CLAMAV error

by Roger Emery -

My 1.7 keeps giving errors too when files are uploaded:

"Clam AV has failed to run. The return error message was There was an unknown error with clam.. Here is the output from Clam:"

But there is no "output" from Clam so haven't clue what's going on there. The path (C:\ClamWin\bin\clamscan.exe) is correct and clam works fine when launched from the server...hmmm

In reply to Roger Emery

Re: CLAMAV error

by Frank Claessen -
Hi all,

same problem at this side of the Caribbean Sea.
Version: Moodle 1.7+ (2006101009)
PHP: 5.1.6
MySQL:5.0.21

I have tried the following solutions until now:

c:\program files\clamwin\bin --> system tells me it is the wrong path
c:\program files\clamwin\bin\ --> system tells me it is the wrong path
c:\program files\clamwin\bin\clamscan.exe --> program is started now but give error message as was shown through Roger above!

I have also tried the following also:

'c:\program files\clamwin\\bin\clamscan.exe' - using quotes that is - didn't work at all

and

c:\\program files\\clamwin\\bin\\clamscan.exe - both with and without quotes - same result - doesn't work

I am out of options.

Is it perhaps a file permission thingy? Or are we talking bugs here?

I'll keep looking for an answer myself

Frank
In reply to Frank Claessen

Re: CLAMAV error

by Monika Sawicka -

In case of ClamWin you need specify a path to database. Probably it is under Documents and Settings on your server. You can check the location of database if you open ClamWin panel on your server and then properties and then files tab. There you should find it.

To run clamscan form command prompt (this is what moodle does) you need to specify:

C:\Program Files\ClamWin\bin\clamscan.exe --database="C:\Documents and Settings\All Users\.clamwin\db" --recursive your_file_name

In my case it works fine form command prompt on the server, but if I try to pass it through php it doesn’t (file lib/ uploadlib.php function clam_scan_file.

Instead of:

$cmd = $CFG->pathtoclam .' '. $fullpath ." 2>&1";

I put

$cmd = $CFG->pathtoclam .' --database="C:/Documents and Settings/All Users/.clamwin/db" --recursive '. $fullpath ." 2>&1";) .

I guess there is something wrong with passing string through php to command prompt on server IIS. It finishs an execution on $CFG->pathtoclam, so cannot enter database and scanned file. (That's why the message returned by clamwin says: scanned files:0)

Maybe someone has an idea how to pass it? Or maybe there is some function of php which passes paths correctly ?

Best regards and good luck

In reply to Monika Sawicka

Re: CLAMAV error

by Stephen Jessop -

We have Moodle 1.7 and to get moodle to upload a file and clamav to scan it we created a batch file containing this

c:\clamwin\bin\clamscan --database="C:\Documents and Settings\All Users\.clamwin\db" --recursive "%1 %2"

the %1 %2 is because I have moodle in a folder with a space it it folder name, if there is no space you only need %1 and no quotes.

In moodles security AV path we have C:\clamwin\bin\clamscan.bat,  this calls the batch file and clamav scans the file with no problem.

In reply to Stephen Jessop

Re: CLAMAV error

by Jon Witts -
Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers
I have been trying to get this working on Windows for some time now, see my original discussion here. I have tried to follow your instructions about the batch file but I still get the same error returned from CLAMWIN.

Clam AV has failed to run. The return error message was There was an unknown error with clam.. Here is the output from Clam:

My Moodle is installed on a different drive to ClamWin, would this have any effect on the set up?

Any help you could offer would be greatly appreciated.

I am running Moodle 1.5.4, M$ 2003 R2, MySQL 4.1.20 and PHP 5.2.0 FYI.

Regards,

Jon
In reply to Jon Witts

Re: CLAMAV error

by John Mc Hale -

The problem with clamscan.exe, when it is called from a command shell within Moodle, it does'nt know how to locate the anti-virus database definitions.

The following is a proposed fix for this problem, which HAS ONLY BEEN TESTED ON WINDOWS PLATFORMS; i.e. Windows 2003 Server SP2, Moodle 1.61, Apache 2.2.x, MySQL 5.0.x.

It requires a very small amount of coding, and a little bit of bravery, as follows:

1. save the attached file 'clamwinfix.php' in the /lib folder of your moodle directory.

2. using your favourite text editor (wordpad.exe will do nicely, but I prefer programmers file editor with line numbering), open the file 'uploadlib.php'.

3. at the top of the file (under the revision information), paste the following:

/**

* modification to addess clam for windows problems

*/

require("clamwinfix.php");

4. The top of your file should now look something like:

<?php

/**

* uploadlib.php - This class handles all aspects of fileuploading

*

* @author ?

* @version $Id: uploadlib.php,v 1.17.2.2 2006/05/17 18:15:43 skodak Exp $

* @license http://www.gnu.org/copyleft/gpl.html GNU Public License

* @package moodlecore

*/

/**

* modification to addess clam for windows problems

*/

require("clamwinfix.php");

//error_reporting(E_ALL ^ E_NOTICE);

5. In 'uploadlib.php', find the function 'clam_scan_file (the function declaration is around line 586 in version 1.6.1).

6. insert the modifications highlighted in bold and enlarged text.

function clam_scan_file(&$file, $course) {

global $CFG, $USER;

global $notice;

$notice = '';

if (is_array($file) && is_uploaded_file($file['tmp_name'])) { // it's from $_FILES

$appendlog = true;

$fullpath = $file['tmp_name'];

}

else if (file_exists($file)) { // it's a path to somewhere on the filesystem!

$fullpath = $file;

}

else {

return false; // erm, what is this supposed to be then, huh?

}

$CFG->pathtoclam = trim($CFG->pathtoclam);

$clamdatabasedir = clamwin_database_dir();

if (!$CFG->pathtoclam || !file_exists($CFG->pathtoclam) || !is_executable($CFG->pathtoclam) || !$clamdatabasedir){

$newreturn = 1;

$notice = get_string('clamlost', 'moodle', $CFG->pathtoclam);

if ($CFG->clamfailureonupload == 'actlikevirus') {

$notice .= "\n". get_string('clamlostandactinglikevirus');

$notice .= "\n". clam_handle_infected_file($fullpath);

$newreturn = false;

}

clam_mail_admins($notice);

if ($appendlog) {

$file['uploadlog'] .= "\n". get_string('clambroken');

$file['clam'] = 1;

}

return $newreturn; // return 1 if we're allowing clam failures

}

$cmd = $CFG->pathtoclam .' '. $clamdatabasedir .' '. $fullpath ." 2>&1";

// before we do anything we need to change perms so that clamscan can read the file (clamdscan won't work otherwise)

chmod($fullpath,0644);

7. *NB* - this fix looks for the ClamWin.conf configuration file, which is located in the bin directory of your ClamWin installation. There must be a database directive in this file pointing to the folder containing the anti-virus definitions. This path may contain spaces; e.g.

[ClamAV]
clamscan=C:\ClamWin\bin\clamscan.exe
freshclam=C:\ClamWin\bin\freshclam.exe
database=C:\Documents and Settings\All Users\.clamwin\db

Hope this solves your problem!

In reply to Eric Henson

Re: CLAMAV error

by Eric Henson -

Because I am getting the following error "can't initialize the virus database", I am guessing that this is telling me that my path might need to include the location of the virus database.  Does anyone that runs a Linux server  have any ideas on this problem?

Thanks,

In reply to Eric Henson

Re: CLAMAV error

by Mikel Stous -
Did you run freshclam -v to get the updates as root or do you have a clamav user (recommended)?

The typical place for the virus defs are in /usr/share/clamav or /usr/local/share/clamav

From the clamav binary distributions documentation:

SuSE Might reinstall the packages, or recompile the packages.
In reply to Eric Henson

Re: CLAMAV error

by John Mc Hale -

See my earlier post re: fixing Clam AV on windows platforms. I have since worked on a solution, which should (in  theory at least) work on UNIX style platforms, but I have no way to test same as I don't have a UNIX box.

 

*Requirements

1. your clam directory on the UNIX box has a configuration file (*.conf) in the same directory as the clamscan executable file (/usr/bin ?).

2. the forementioned configuration file has a configuration setting:

database=

, which is the path to the anti-virus database folder

 

*Instructions

1. Download the attached file 'clamfix.php' to your Moodle /lib directory

2. Make a couple of minor modifications to the 'uploadlib.php' file in the same directory as follows:

2.a) at the top of the file (under the revision information), paste the following:

/**

* modification to addess clam problems

*/

require("clamfix.php");

4. The top of your file should now look something like:

<?php

/**

* uploadlib.php - This class handles all aspects of fileuploading

*

* @author ?

* @version $Id: uploadlib.php,v 1.17.2.2 2006/05/17 18:15:43 skodak Exp $

* @license http://www.gnu.org/copyleft/gpl.html GNU Public License

* @package moodlecore

*/

/**

* modification to addess clam problems

*/

require("clamfix.php");

//error_reporting(E_ALL ^ E_NOTICE);

2.b) In 'uploadlib.php', find the function 'clam_scan_file (the function declaration is around line 586 in version 1.6.1) and insert the modifications highlighted in bold and enlarged text.

function clam_scan_file(&$file, $course) {

global $CFG, $USER;

global $notice;

$notice = '';

if (is_array($file) && is_uploaded_file($file['tmp_name'])) { // it's from $_FILES

$appendlog = true;

$fullpath = $file['tmp_name'];

}

else if (file_exists($file)) { // it's a path to somewhere on the filesystem!

$fullpath = $file;

}

else {

return false; // erm, what is this supposed to be then, huh?

}

$CFG->pathtoclam = trim($CFG->pathtoclam);

$clamdatabasedir = clam_database_dir();

if (!$CFG->pathtoclam || !file_exists($CFG->pathtoclam) || !is_executable($CFG->pathtoclam) || !$clamdatabasedir){

$newreturn = 1;

$notice = get_string('clamlost', 'moodle', $CFG->pathtoclam);

if ($CFG->clamfailureonupload == 'actlikevirus') {

$notice .= "\n". get_string('clamlostandactinglikevirus');

$notice .= "\n". clam_handle_infected_file($fullpath);

$newreturn = false;

}

clam_mail_admins($notice);

if ($appendlog) {

$file['uploadlog'] .= "\n". get_string('clambroken');

$file['clam'] = 1;

}

return $newreturn; // return 1 if we're allowing clam failures

}

$cmd = $CFG->pathtoclam .' '. $clamdatabasedir .' '. $fullpath ." 2>&1";

// before we do anything we need to change perms so that clamscan can read the file (clamdscan won't work otherwise)

chmod($fullpath,0644);

If any UNIX user tests this solution, please reply to this post.

In reply to John Mc Hale

Re: CLAMAV error

by John Mc Hale -
Bug found in attached file 'clamfix.php' - here is the most recent one
In reply to John Mc Hale

Re: CLAMAV error

by W Jacobs -

I am running my Moodle server on a windows 2003 server and running into the same issue. The last post for this issue was in 07. I find it hard to believe that no one has figured this out yet. I ran all the fixes as shown above with no positive results. From what I gather from all my testing is that the scan is working but it can read into the database defs. I noticed this on the error I get via email is that the line that says "known viruses=0". I dont know why and can read this but I do have it under c\clamwin\db and set it accordingly in my preferences in Clam. Has anyone got this working or is anyone working on it??

If no one has gotten it working then just what is all the Windows people doing to scan their uploads? If there doing nothing then the open source programmers for Moodle should be taking this quite serious.

BTW: here is the text in the error message I get:

Clam AV has failed to run.  The return error message was Database
initialization error.. Here is the output from Clam:


----------- SCAN SUMMARY -----------
Known viruses: 0 <<<<<<<<<<<<<<<This is the line I'm talking about
Engine version: 0.94.1
Scanned directories: 0
Scanned files: 0
Infected files: 0
Data scanned: 0.00 MB
Time: 0.000 sec (0 m 0 s)
LibClamAV Error: cli_loaddb(): No supported database files found in .<<and here
ERROR: Not supported data format

In reply to John Mc Hale

Re: CLAMAV error

by W Jacobs -

Hello John

I was looking at your code for the clamfix.php and had a question

function clam_database_dir(){

    global $CFG;

    // copy global to local for efficiency
    $pathtoclam = $CFG->pathtoclam;
   
    // variables to store location of last path seperator character found in clamscan file path
    $locunixseperator = 0;
    $locwinseperator = 0;
   
    // this is the item in the config file that we're looking for (i.e. the Clam database path)
    $configitem = "database";
   
    // default clam av database dir POSIX compliance???
    $clamdatabasepath = "."; << Should I put in the path to my database here?

like c:\clamwin\db   ?????

Thanks