clamscan TNEF error

caloss · 02-09-2015, 07:53 AM

Hi there,

I'm using Opensuse 13.1 and clamav 0.98.5
When running "clamscan -r -i /home" I get the follwowing errors

LibClamAV Warning: Corrupt TNEF header detected - length -55533415
LibClamAV Warning: Corrupt TNEF header detected - length -1723598532
LibClamAV Warning: TNEF - unknown level 55 tag 0x3331
LibClamAV Warning: TNEF - unknown level 32 tag 0x2000
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 3 tag 0xe00
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 3 tag 0x16
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 3 tag 0x16
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 3 tag 0xe00
LibClamAV Warning: TNEF - unknown level 3 tag 0xe00
LibClamAV Warning: TNEF - unknown level 3 tag 0xe00
LibClamAV Warning: TNEF - unknown level 22 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 3 tag 0xe00
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 128 tag 0x3
LibClamAV Warning: TNEF - unknown level 15 tag 0x1
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 32 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 14 tag 0x0
LibClamAV Warning: TNEF - unknown level 61 tag 0x204
LibClamAV Warning: TNEF - unknown level 104 tag 0x756e
LibClamAV Warning: TNEF - unknown level 3 tag 0x2d00
LibClamAV Warning: TNEF - unknown level 3 tag 0x16
LibClamAV Warning: TNEF - unknown level 3 tag 0x2e00
LibClamAV Warning: TNEF - unknown level 3 tag 0x2e00
LibClamAV Warning: cli_scanicon: found 3 invalid icon entries of 3 total

Can anybody tell me
- what this means,
- how I can solve it or
- how I can identfy the files responsible for these errors

thx in advance & best regards
cl

John VV · 02-09-2015, 04:00 PM

is this the default clam in the 13.1 LTS repos ?
or did you build the older code 98.6 is current
http://www.clamav.net/download.html
or the TESTING on git

Code:

 git clone git://github.com/vrtadmin/clamav-devel

as to the error
when was the last time you updated the clam virus database ?
you should always run "freshclam "( as root) BEFORE running clamscan

Code:

su -
--- root password ---
freshclam

exit
cd /
clamscan -r -i /home

caloss · 02-10-2015, 03:32 AM

John, thanks for the quick answer.

I updated clamav to stable version 98.6 but the errors persist.

freshclam runs once per hour by a cron job and the database is up to date.

I figured out, that the responsible files are emails stored by dovecot in the directory /home/user/mailbox.

However the amount of mails there is huge and I'm not able to identify the ones causing the problem.