[clamav-users] After 0.100.1 Update, clamd crashes

[Fraenzl, Martin]

Hi all,

I'm using clamav as scanner for my Exim MTA.
Since I updated from 0.99.4 to 0.100.1, Exim is not able to connect to clamd.

ps -afe | grep clam
clamav 19586 1 0 10:32 ? 00:00:00 /usr/sbin/clamd
clamav 19596 1 0 10:32 ? 00:00:00 /usr/bin/freshclam -d


After the first connect from exim to the clamd socket, clamd crashes.

clamd /var/run/clamav/clamd.sock : unable to read from socket (EOF)

ps -afe | grep clam
clamav 19596 1 0 10:32 ? 00:00:00 /usr/bin/freshclam -d

Did anyone have the same issus with the update.


Cheers,
Martin


Diese E-Mail kann vertrauliche Informationen enthalten und irrt?mlich an Sie gelangt sein. In diesem Fall informieren Sie bitte sofort die Absenderin bzw. den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder von Teilen dieser Mail sind nicht gestattet.

Informationen gem?? DSGVO zur Verarbeitung personenbezogener Daten durch die OeNB finden Sie unter www.oenb.at/datenschutz<https://www.oenb.at/datenschutz>.

[Vladislav Kurz]

Post by Fraenzl, Martin
Hi all,
 
I’m using clamav as scanner for my Exim MTA.
Since I updated from 0.99.4 to 0.100.1, Exim is not able to connect to clamd.

If you are using unofficial rules, disable yara rules.

https://github.com/extremeshok/clamav-unofficial-sigs/issues/203
--
best Regards
Vladislav Kurz

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Fraenzl, Martin]

Thanks, Vladislav for the quick reply!

That´s exactly the problem, deleting *.yar and *.yara solved it!

Cheers,
Martin

-----Ursprüngliche Nachricht-----
Von: clamav-users <clamav-users-***@lists.clamav.net> Im Auftrag von Vladislav Kurz
Gesendet: Dienstag, 31. Juli 2018 11:22
An: clamav-***@lists.clamav.net
Betreff: Re: [clamav-users] After 0.100.1 Update, clamd crashes

Post by Fraenzl, Martin
Hi all,
I'm using clamav as scanner for my Exim MTA.
Since I updated from 0.99.4 to 0.100.1, Exim is not able to connect to clamd.

If you are using unofficial rules, disable yara rules.

https://github.com/extremeshok/clamav-unofficial-sigs/issues/203

--
best Regards
Vladislav Kurz

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
_________________
Diese Nachricht wurde vom OeNB Mailserver TLS verschluesselt empfangen

Diese E-Mail kann vertrauliche Informationen enthalten und irrtümlich an Sie gelangt sein. In diesem Fall informieren Sie bitte sofort die Absenderin bzw. den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder von Teilen dieser Mail sind nicht gestattet.

Informationen gemäß DSGVO zur Verarbeitung personenbezogener Daten durch die OeNB finden Sie unter www.oenb.at/datenschutz<https://www.oenb.at/datenschutz>.
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Steve Basford]

Just posting a little regarding the Yara issue with 0.100.x:

After a little bit of testing last week... here's what was found:

It seems that in ClamAV 0.100.x if the yara file uses pe.imports *and* has
*multiple* rules inside the single Yara file, it seems to crash linux
versions of ClamAV.


If the Yara rule uses pe.imports (which btw, isn't supported in CLamAV)
and changed from:

all of ($user*) and pe.imports("advapi32.dll")

to:


all of ($user*)


Then ClamAV doesn't crash in 0.100.x.

Whereas leaving the rule intact (in pre 0.100.x) it just didn't crash.


There a buzilla about it here:


https://bugzilla.clamav.net/show_bug.cgi?id=12077#c14


My little issue is with this statement:

"It wasn't quite clear at the offset of this bug, but ClamAV cannot
support unofficial signatures from a development standpoint. For numerous
reasons, we do not regress against those signatures, and in cases where
sig writers publish non-functional signatures due to insufficient testing
(which then cause crashes in newer versions of clam) we cannot devote our
resources to fixing that problem." (above Bugzilla)


I can see where the above is coming from generally... *but* it's always
been known that Yara pe module import was an issue...

eg:


https://blog.clamav.net/2015/06/clamav-099b-meets-yara.html

"There are currently a few limitations of YARA rules within ClamAV 0.99
beta1, due either to nonexistent ClamAV capabilities or to YARA features
that did not fit well into the ClamAV processing model. We hope to further
evaluate and include as much of this functionality as possible in
subsequent releases. YARA rules using any of the following features will
be **** flagged in error, and the respective rules will be disabled **** :

* Modules – A YARA feature intended to provide modular extensions to the
YARA core. Modules are normally activated using the import keyword. "


So, I feel that the issue is not the fact that ClamAV isn't supporting the
import module... but the fact that now ClamAV crashes on 0.100.x where
before it didn't.

Yararules won't change their rules which need the pe.import module,
because well, that's how Yara will detect things on non-ClamAV software.
--
Cheers,

Steve
Twitter: @sanesecurity

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www

[Micah Snyder (micasnyd)]

Thanks for the analysis, Steve. That is a step towards understanding how to fix it.

I don't believe it's a new bug in 0.100, but was merely revealed due to legitimate improvements in the yara sig loading behavior.

In 0.99.x some of the rules failed entirely, so the entire database was dropped. In 0.100, some of the rules failed, but it now allows it to partially load the ones that didn't outright fail. However, there appears to be a bug wherein at least one that is getting loaded is causing a crash.

It wouldn't be a good fix to go back and change so it drops the whole ruleset because one failed to load. The correct fix would be to detect signature features that aren't supported before we attempt to load them so we can drop them.

I welcome any additional research from the community to help find a fix for this. We have a lot on our plates, and don't have any time dedicated to fix this one ourselves for 0.101.

Regards,
Micah

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jul 31, 2018, at 7:50 AM, Steve Basford <***@sanesecurity.com<mailto:***@sanesecurity.com>> wrote:

Just posting a little regarding the Yara issue with 0.100.x:

After a little bit of testing last week... here's what was found:

It seems that in ClamAV 0.100.x if the yara file uses pe.imports *and* has
*multiple* rules inside the single Yara file, it seems to crash linux
versions of ClamAV.


If the Yara rule uses pe.imports (which btw, isn't supported in CLamAV)
and changed from:

all of ($user*) and pe.imports("advapi32.dll")

to:


all of ($user*)


Then ClamAV doesn't crash in 0.100.x.

Whereas leaving the rule intact (in pre 0.100.x) it just didn't crash.


There a buzilla about it here:


https://bugzilla.clamav.net/show_bug.cgi?id=12077#c14


My little issue is with this statement:

"It wasn't quite clear at the offset of this bug, but ClamAV cannot
support unofficial signatures from a development standpoint. For numerous
reasons, we do not regress against those signatures, and in cases where
sig writers publish non-functional signatures due to insufficient testing
(which then cause crashes in newer versions of clam) we cannot devote our
resources to fixing that problem." (above Bugzilla)


I can see where the above is coming from generally... *but* it's always
been known that Yara pe module import was an issue...

eg:


https://blog.clamav.net/2015/06/clamav-099b-meets-yara.html

"There are currently a few limitations of YARA rules within ClamAV 0.99
beta1, due either to nonexistent ClamAV capabilities or to YARA features
that did not fit well into the ClamAV processing model. We hope to further
evaluate and include as much of this functionality as possible in
subsequent releases. YARA rules using any of the following features will
be **** flagged in error, and the respective rules will be disabled **** :

* Modules – A YARA feature intended to provide modular extensions to the
YARA core. Modules are normally activated using the import keyword. "


So, I feel that the issue is not the fact that ClamAV isn't supporting the
import module... but the fact that now ClamAV crashes on 0.100.x where
before it didn't.

Yararules won't change their rules which need the pe.import module,
because well, that's how Yara will detect things on non-ClamAV software.
--
Cheers,

Steve
Twitter: @sanesecurity

_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Eric Tykwinski]

Micah,



Running master branch from GitHub: ClamAV 0.101.0/24799/Tue Jul 31 04:44:57 2018



It doesn’t seem to have an issue, as far as I can tell.



# clamscan --debug 2>&1 /dev/null | grep "loaded" | grep yara
LibClamAV debug: load_oneyara: successfully loaded YARA.AnglerEKredirector

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash2

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash4

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash5

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_flash_uncompressed

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_html

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_html2

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.angler_js

LibClamAV debug: cli_loadyara: loaded 10 of 10 yara signatures from /var/lib/clamav/EK_Angler.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar2

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_jar3

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_pdf

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole_basic

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole1_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_css

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm10

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm11

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm12

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm3

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm4

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm5

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm6

LibClamAV debug: load_oneyara: successfully loaded YARA.blackhole2_htm8

LibClamAV debug: cli_loadyara: loaded 16 of 16 yara signatures from /var/lib/clamav/EK_Blackhole.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_adobe_2010_1297_exploit

LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_adobe_2010_2884_exploit

LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_jar2

LibClamAV debug: load_oneyara: successfully loaded YARA.bleedinglife2_java_2010_0842_exploit

LibClamAV debug: cli_loadyara: loaded 4 of 4 yara signatures from /var/lib/clamav/EK_BleedingLife.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.crimepack_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.crimepack_jar3

LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Crimepack.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar2

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_jar3

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js2

LibClamAV debug: load_oneyara: successfully loaded YARA.eleonore_js3

LibClamAV debug: cli_loadyara: loaded 6 of 6 yara signatures from /var/lib/clamav/EK_Eleonore.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_htm

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js2

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_flash

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_java

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_quicktime

LibClamAV debug: load_oneyara: successfully loaded YARA.fragus_js_vml

LibClamAV debug: cli_loadyara: loaded 7 of 7 yara signatures from /var/lib/clamav/EK_Fragus.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html10

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html11

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html2

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html3

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html4

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html5

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html6

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html7

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html8

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_html9

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar2

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_jar3

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf2

LibClamAV debug: load_oneyara: successfully loaded YARA.phoenix_pdf3

LibClamAV debug: cli_loadyara: loaded 17 of 17 yara signatures from /var/lib/clamav/EK_Phoenix.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.sakura_jar

LibClamAV debug: load_oneyara: successfully loaded YARA.sakura_jar2

LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Sakura.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_css

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_css2

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_htm

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js2

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js3

LibClamAV debug: load_oneyara: successfully loaded YARA.zeroaccess_js4

LibClamAV debug: cli_loadyara: loaded 7 of 7 yara signatures from /var/lib/clamav/EK_ZeroAcces.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.zerox88_js2

LibClamAV debug: load_oneyara: successfully loaded YARA.zerox88_js3

LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/EK_Zerox88.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.zeus_js

LibClamAV debug: cli_loadyara: loaded 1 of 1 yara signatures from /var/lib/clamav/EK_Zeus.yar

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type4_Hdr_2

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type3_Bdy_4

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_TestSig_Type4_Bdy_3

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_PhishingTestSig_1

LibClamAV debug: cli_loadyara: loaded 4 of 4 yara signatures from /var/lib/clamav/Sanesecurity_sigtest.yara

LibClamAV debug: /var/lib/clamav/Sanesecurity_sigtest.yara loaded

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_Spam_test

LibClamAV debug: load_oneyara: successfully loaded YARA.Sanesecurity_Spam_pornspam

LibClamAV debug: cli_loadyara: loaded 2 of 2 yara signatures from /var/lib/clamav/Sanesecurity_spam.yara

LibClamAV debug: /var/lib/clamav/Sanesecurity_spam.yara loaded

LibClamAV debug: load_oneyara: successfully loaded YARA.OITC_pdf_with_emb_docm

LibClamAV debug: load_oneyara: successfully loaded YARA.INDICATOR_IMPLANT_Loader

LibClamAV debug: load_oneyara: successfully loaded YARA.INDICATOR_Implant_Loader2

LibClamAV debug: load_oneyara: generic string: [File {0} has been uploaded in {1}] => [46696c65207b307d20686173206265656e2075706c6f6164656420696e207b317d]

LibClamAV debug: load_oneyara: successfully loaded YARA.IMPLANT2_3

LibClamAV debug: load_oneyara: successfully loaded YARA.CryptoWall_Resume_phish

LibClamAV debug: load_oneyara: successfully loaded YARA.java_JSocket_20151217

LibClamAV debug: load_oneyara: successfully loaded YARA.detect_powershell_precursor_downloader

LibClamAV debug: load_oneyara: successfully loaded YARA.kmon_cred_phish

LibClamAV debug: load_oneyara: successfully loaded YARA.rtf_phishing_script_lines

LibClamAV debug: cli_loadyara: loaded 9 of 9 yara signatures from /var/lib/clamav/winnow_malware.yara

LibClamAV debug: /var/lib/clamav/winnow_malware.yara loaded



Sincerely,



Eric Tykwinski

TrueNet, Inc.

P: 610-429-8300



From: clamav-users [mailto:clamav-users-***@lists.clamav.net] On Behalf Of Micah Snyder (micasnyd)
Sent: Tuesday, July 31, 2018 8:51 AM
To: ***@sanesecurity.com; ClamAV users ML
Subject: Re: [clamav-users] After 0.100.1 Update, clamd crashes



Thanks for the analysis, Steve. That is a step towards understanding how to fix it.



I don't believe it's a new bug in 0.100, but was merely revealed due to legitimate improvements in the yara sig loading behavior.

In 0.99.x some of the rules failed entirely, so the entire database was dropped. In 0.100, some of the rules failed, but it now allows it to partially load the ones that didn't outright fail. However, there appears to be a bug wherein at least one that is getting loaded is causing a crash.

It wouldn't be a good fix to go back and change so it drops the whole ruleset because one failed to load. The correct fix would be to detect signature features that aren't supported before we attempt to load them so we can drop them.



I welcome any additional research from the community to help find a fix for this. We have a lot on our plates, and don't have any time dedicated to fix this one ourselves for 0.101.



Regards,

Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

[G.W. Haywood]

Hi there,

Post by Steve Basford
"It wasn't quite clear at the offset of this bug, but ClamAV cannot
support unofficial signatures from a development standpoint. For numerous
reasons, we do not regress against those signatures, and in cases where
sig writers publish non-functional signatures due to insufficient testing
(which then cause crashes in newer versions of clam) we cannot devote our
resources to fixing that problem." (above Bugzilla)

I'll take issue with that statement too. That's a ***@p developer attitude.

If an unofficial signature causes (or is even _capable_ of causing) clam
to crash, that's a fault in clam that needs to be fixed.

If nothing else it means that you're quite likely less secure if you're
running clam on Linux than you are if you're _not_ running it.
--
73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Micah Snyder (micasnyd)]

Ged,

Meaning no offense here - but not every crash is a security vulnerability. You shouldn't trust 3rd party signatures unless you trust the source of the signatures.

We take vulnerabilities in parsing untrusted user input (such as when scanning a file or email) very seriously. Signature databases, on the other hand, should qualify as trusted input.

If there is a known defect in how a signature is parsed - we can avoid it until such time as we have the ability to fix the feature. To be clear, Mickey stated that in the ticket that we're leaving the ticket open because it is very clearly a bug that we intend to fix. However, we have a lot on our plates and very few developers. If you have the time to find a good fix for it, we'll take your patch or pull request.

Respectfully,
Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.


On Jul 31, 2018, at 1:14 PM, G.W. Haywood <***@jubileegroup.co.uk<mailto:***@jubileegroup.co.uk>> wrote:

Hi there,

On Tue, 31 Jul 2018, Steve Basford wrote:

My little issue is with this statement:
"It wasn't quite clear at the offset of this bug, but ClamAV cannot
support unofficial signatures from a development standpoint. For numerous
reasons, we do not regress against those signatures, and in cases where
sig writers publish non-functional signatures due to insufficient testing
(which then cause crashes in newer versions of clam) we cannot devote our
resources to fixing that problem." (above Bugzilla)

I'll take issue with that statement too. That's a ***@p developer attitude.

If an unofficial signature causes (or is even _capable_ of causing) clam
to crash, that's a fault in clam that needs to be fixed.

If nothing else it means that you're quite likely less secure if you're
running clam on Linux than you are if you're _not_ running it.

--

73,
Ged.
_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net<mailto:clamav-***@lists.clamav.net>
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

[Eric Tykwinski]

-----Original Message-----
Behalf Of Paul Kosinski
Sent: Tuesday, July 31, 2018 2:42 PM
Subject: Re: [clamav-users] After 0.100.1 Update, clamd crashes

<...>

Software should *never* crash when presented with invalid input,
especially if the input arrives via the Internet. And it's quite
conceivable that some especially clever bad guy might attack the source
of signatures to incapacitate ClamAV, or, in the worst case, to cause it
to execute arbitrary code instead of "merely" crashing.

Yeah, I think everyone pretty much can agree with that.
And it's not like it's uncommon, Gentoo just got wacked last month.

As far as helping to fix the issue, what yara rule was causing the issue on
100.1?
https://github.com/Yara-Rules/rules/blob/master/Antidebug_AntiVM/antidebug_a
ntivm.yar

This one always fails a few, so I tested this out.
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 497
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 512
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 528
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 544
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 557
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 603
undefined identifier "pe"
LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 614
undefined identifier "pe"
LibClamAV Warning: cli_loadyara: failed to parse or load 7 yara rules from
file /var/lib/clamav/antidebug_antivm.yar, successfully loaded 92 rules.

For loaded sigs:
LibClamAV Warning: cli_loadyara: failed to parse or load 7 yara rules from
file /var/lib/clamav/antidebug_antivm.yar, successfully loaded 92 rules.

If you guys need my config.log for versions of dependencies or anything just
let me know.
Running 18.04 Ubuntu with OpenSSL 1.1.1, so total dev environment, but looks
like this release is 57 diffs from 100.1 release.


_______________________________________________
clamav-users mailing list
clamav-***@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml