Atomicorp

HI,

today received this error from clamav:
/var/log/messages: /var/log/pas/maillog: attached was this pdf
http://www.nttdocomo.co.jp/corporate/ir ... /vol41.pdf

What can be done to prevent this or what is the exact error? Maybe the japanese characters?

thanks for any help

Hmmm, that is weird... looks like a bug in clamav 0.96.3 as I can reproduce this on Fedoras, Redhats and Centos 93 builds but not on 96.2 builds. So its something core in clamav thats not liking this PDF that was introduced between 96.2 and 96.3.

We'll look into a fix ASAP. I think I know what was changed upstream that may be causing this.

Thanks a lot for the quick reply. Good to know that it's a bug, I wa a little bit confused why this happens.
Let me know if I can help in some way.

I've got what I need, and thank you for including the file.

You are welcome and I have to thank you. I totally agree with biggles statement (in the other post) and I can only praise yours and Scotts work. I'm very happy to be customer of yours and never regret my subscription. I wish I could contibute more.

Thank you very much for the compliment, it really means a lot to know we're doing a good job and are keeping you a happy customer.

As always, if there is anything we can do to help you or anything you'd like to see in our products (or maybe a product we hadn't though of) please let us know.

Found the buggy code, working on a fix. Looks like its also been found upstream. Should have an update available soon.

It's great to make compliments to people that deserve it like you do.
And I like people to know that they do a very good job and that I'm thankful.
Thank you very much for working on this issue that quick.

Do you have some more details on this problem? Is it smart to not install 0.93-1 and wait for an update which fixes this problem? Or is it a pretty rare condition which triggers this problem and are we better off running 0.93 instead of staying on 0.92 for a bit?

In my opinion I would wait until Mike has an update unless you have a really good reason not to wait.
I don't know how rare this case is. I have installed the update on friday night and experienced this error one day later.
But this could be coincedence. My server is not high loaded since I handle a few customers.
Mike could tell you if this case is rare based on the fact that he knows what is causing this error.
I will stay with this version and wait for the update.
And I will keep you up2date if I get more of these cases.

0.96.4 is out now in the asl-2.0 channel which fixes this bug.

[tester0@qa2 ~]$ clamscan -V
ClamAV 0.96.3/12191/Sat Oct 30 19:25:54 2010
[tester0@qa2 ~]$ clamscan vol41.pdf
vol41.pdf: Unknown error code ERROR

[tester0@qa2 ~]$ clamscan -V
ClamAV 0.96.4/12191/Sat Oct 30 19:25:54 2010
[tester0@qa2 ~]$ clamscan vol41.pdf
vol41.pdf: OK

Do you have some more details on this problem? Is it smart to not install 0.93-1 and wait for an update which fixes this problem? Or is it a pretty rare condition which triggers this problem and are we better off running 0.93 instead of staying on 0.92 for a bit?

It was a very rare case, so most folks would probably not see it happen IMHO. Regardless, 0.96.4 is out and we recommend you upgrade. That fixes the bug, and includes other bug fixes and improvements.

installed the updates and resend an email with this attachment for testing purposes.
works like a charme.
thanks Mike for the great and quick fix.
Enjoy the rest of your holi-half-day