Potential threats found but nothing in history

[nezos]

I am on Debian Stretch with Clamtk v5.24, did two times a full scan and although two times it showed in the end that there were 6 potential threats nothing was recorded in history.

[dave-theunsub]

Hi,

Can you open a terminal window, type "clamtk" (no quotes), hit enter, and run the scan again? If there are errors, it will likely show up in the terminal window. Let me know if it does, and what you see.

respectfully Dave M

[nezos]

~$ clamtk Gtk-Message : Failed to load module "canberra-gtk-module" at /usr/lib/x86_64-linux-gnu/perl5/5.24/Gtk2.pm line 126. ** unhandled exception in callback: Cannot decode string with wide characters at /usr/lib/x86_64-linux-gnu/perl/5.24/Encode.pm line 202. *** ignoring at /usr/share/perl5/ClamTk/GUI.pm line 145.

The Gtk-Message appears after executing it, the rest I saw them after the scan. It scanned for around 10hours.

[dave-theunsub]

Hi,

You're missing a dependency. Try "sudo apt-cache search canberra-gtk-module" - one or two of the results should be something like "libcanberra-gtk3-module" or "libcanberra-gtk2-module", and should solve the problem.

respectfully Dave M

[nezos]

Hi Dave and thanks for your reply.

I installed libcanberra-gtk-module and the first message ("Gtk-Message **: Failed to load module...") disappeared but the problem still persists:

:clamtk unhandled exception in callback: Cannot decode string with wide characters at /usr/lib/x86_64-linux-gnu/perl/5.24/Encode.pm line 202. *** ignoring at /usr/share/perl5/ClamTk/GUI.pm line 145.

Now that I think of it again I should not that it scans also a NTFS partition. Does this matter?

[dave-theunsub]

Hi,

You are correct that you should not use it on NTFS partitions. It may work but I don't test it there, and have no idea how it will respond. I recommend using a tool specifically made for Windows to scan Windows, such as ClamWin.

Still, the error message should not appear. What is the file name that it's choking on? Seems like it'll be the one with non-ascii characters in it. :) It'd be nice to have that name so I can test and see what's going on.

respectfully Dave M

[himizu]

Same issue clamtk & clamtk-gnome on ubuntu 16.04 clamtk 5.20-1(repository package). Same issue clamtk & clamtk-gnome on ubuntu 16.04 clamtk 5.24(from ubuntu 17.04 source package).

My locale is ja_JP.UTF-8. Linux ext4 partition.

modify perl script (clamtk 5.24 ubuntu package).

--- Scan.pm.org 2017-02-21 18:05:52.287935677 +0900
+++ Scan.pm.mod 2017-02-22 20:31:58.410695349 +0900
@@ -535,8 +535,11 @@
     my $REPORT;    # filehandle for histories log

     #<<<
+    my $ldate = strftime( '%b-%d-%Y', localtime );
+    $ldate =~ s/ //g;
+
     my ( $mon, $day, $year )
-        = split / /, strftime( '%b %d %Y', localtime );
+        = split( /-/, $ldate );

    # Save date of scan
    if ( $found_count > 0 ) {
@@ -550,7 +553,7 @@
     my $paths = ClamTk::App->get_path( 'history' );

     my $virus_log
  -        = $paths . "/" . decode( 'utf8', "$mon-$day-$year" ) . '.log';
  +        = $paths . "/" . "$mon-$day-$year" . '.log';

     #<<<
     # sort the directories scanned for display

It works in ja_JP.UTF-8 & LANG=C. But warning is displayed by terminal ($ clamtk). Wide character in setenv at /usr/lib/x86_64-linux-gnu/perl/5.22/Cwd.pm line 379.

Work around. (Do not change "perl script".) modify clamtk.desktop & clamtk.py.

--- clamtk.desktop.org  2017-02-22 21:56:27.900408828 +0900
 +++ clamtk.desktop.mod 2017-02-22 21:57:10.920766698 +0900
@@ -97,7 +97,7 @@
 Comment[zh_CN]=扫描威胁...
 Comment[zh_TW]=掃描威脅...
 TryExec=clamtk
  -Exec=clamtk %F
  +Exec=env LANG=C clamtk %F
 Icon=clamtk
 Type=Application
 Terminal=false

--- clamtk.py.org   2017-02-22 21:59:10.349757379 +0900
+++ clamtk.py.mod   2017-02-22 22:00:01.950184305 +0900
@@ -32,7 +32,7 @@
         filename = re.escape(filename)

         #os.chdir(filename)
  -        os.system('clamtk %s &' % filename)
  +        os.system('LANG=C clamtk %s &' % filename)

     def menu_activate_cb(self, menu, file):
         self._open_scanner(file)

[nezos]

After himizu's message I also tested on a file that I have with Greek characters in its name on a Ext4 partition and I received again the following (nothing was written in history):

clamtk unhandled exception in callback: Cannot decode string with wide characters at /usr/lib/x86_64-linux-gnu/perl/5.24/Encode.pm line 202. *** ignoring at /usr/share/perl5/ClamTk/GUI.pm line 145.

[himizu]

Sorry. My "POST" had a mistake. Please transfer all LANG=C to LC_TIME=C.

- It works in ja_JP.UTF-8 & LANG=C.
+ It works in ja_JP.UTF-8 & LC_TIME=C.

diff: /usr/shar/applications/clamtk.desktop
-Exec=clamtk %F
+Exec=env LC_TIME=C clamtk %F

diff: /usr/share/nautilus-python/extensions/clamtk.py
-        os.system('clamtk %s &' % filename)
+        os.system('LC_TIME=C clamtk %s &' % filename)

But I work in LANG=C. "threats window" is displayed & history file is made.

PS.. I confirm it again on terminal($ clamtk). ubuntu 16.04 & clamtk 5.24 & modify Scan.pm (No work around). No warning & it works fine.

Two problem on ja_JP.UTF-8.

1. Extra [space] is attached to the month data.

   $ date +'%b %d %Y'
   $  2月 23 2017    <-- 
   $ LC_TIME=C date +'%b %d %Y'
   $ Feb 23 2017     <-- No extra [space].

   /usr/share/perl5/Clamtk/Scan.pm
   ~~~~~snip~~~~~snip~~~~~
    my ( $mon, $day, $year )
        = split / /, strftime( '%b %d %Y', localtime );
   ~~~~~snip~~~~~snip~~~~~
    my $virus_log
        = $paths . "/" . decode( 'utf8', "$mon-$day-$year" ) . '.log';
   ~~~~~snip~~~~~snip~~~~~

   "split / /" recognizes it. result: $mon=null $day=2月 $year=23 [Year(%Y) data is drop.] log file name: -2月-23

2. Error in decode( 'utf8', "$mon-$day-$year" )

   ~~~~~snip~~~~~snip~~~~~
    my $virus_log
        = $paths . "/" . decode( 'utf8', "$mon-$day-$year" ) . '.log';
   ~~~~~snip~~~~~snip~~~~~
   *** unhandled exception in callback:
   ***   Cannot decode string with wide characters at /usr/lib/x86_64-linux-gnu/perl/5.22/Encode.pm line 200.
   ***  ignoring at /usr/share/perl5/ClamTk/GUI.pm line 145.

   ~~~~~snip~~~~~snip~~~~~
        = $paths . "/" . "$mon-$day-$year" . '.log';
   ~~~~~snip~~~~~snip~~~~~

   No error & No warning. "history file" is made, too.

I work only in work around.

[dave-theunsub]

Hi,

I tried duplicating the error on Fedora and CentOS - once using $LANG=en_US.utf8 and scanning files with Japanese characters, and the other time using $LANG=ja_JP.utf8. No errors or warnings. No "luck" for me yet.

I am not an expert with the locale/language settings, but I think $LANG=C is a fallback, isn't it?

I will try with Ubuntu next and report back what I find.

respectfully Dave M

[himizu]

Please refer to: Problem on multibyte characters

[dave-theunsub]

@SunyataZero , can you look at this one? In particular, the link above (https://github.com/himizu/clamtk/commit/e2376bdf6f633d4d87e73f71c5b1b517f4e7254c).

[SunyataZero]

@himizu @dave-theunsub himizu, i don't think this will solve the problem but i can see that you don't have the latest version of clamtk-gnome, can you upgrade using the manual installation steps. (One difference is that re.escape is not used in the latest version)

[himizu]

I am not familiar with Perl script. I do not know whether this correction is right. As a result, it was not a problem of nautilus addon. But The problem shown below was solved.

Condition: Virtualbox host, ClamTk: 5.24, locale: ja_JP.UTF-8
------------------+-----------------+------------------------------------
ubuntu 16.04 LTS  | Perl Ver 5.22.1 | problem (clamtk 5.20 the same, too)
------------------+-----------------+------------------------------------

Condition: Virtualbox guest, ClamTk: 5.24, locale: ja_JP.UTF-8
------------------+-----------------+------------------------------------
debian 8.7 stable | Perl Ver 5.20.2 | work
ubuntu 15.10 EOL  | Perl Ver 5.20.2 | work
------------------+-----------------+------------------------------------
ubuntu 16.10      | Perl Ver 5.22.2 | problem (clamtk 5.22 the same, too)
ubuntu 17.04      | Perl Ver 5.24.1 | problem
fedora 25         | Perl Ver 5.24.1 | problem
------------------+-----------------+------------------------------------

Problem on multibyte characters.
--------------------------------------------------------------------
1. Result(Threats) window is not displayed after scan.
   Occurs in clamtk GUI & nautilus addon.

   Occur decode error of Encode.pm. (Problem from Perl Ver 5.22)

2. History log is not generated.
   Occurs in clamtk GUI & nautilus addon.

   Occur decode error of Encode.pm. (Problem from Perl Ver 5.22)

3. Scan of nautilus addon is unreliable. (an age‐old problem)

   [january] = directory of ascii character name
   [1月]     = file or diectory of multibyte character name
               In the case of a directory, file exists inside.

   case1: [january]
               \----- [1月]  <--  right click & scan

   result: Overall counter does not work. --> Scan is finished.
           Do not seem to scan.

   case2: [january]  <--  right click & scan
               \----- [1月]

   result: Overall counter works.(include [1月]) --> Scan is finished.
--------------------------------------------------------------------

Problem only for ja_JP.UTF-8 ??.
------------------------------------------------------------
1. A format of "history log" is wrong. (an age‐old problem)

   Actual Result   : -mon-day.log     [ -1月-01.log ]
   Expected Result : mon-day-year.log [ 1月-01-2017.log ]
------------------------------------------------------------

[slimer12345]

Hi! I have the same issue with ClamTk 5.24 on Lubuntu 17.04 (Zesty Zapus). When I scan with en_US.UTF-8 locale, there is no issue, but when I'm using ru_RU.UTF-8 instead, then there is no threats window and nothing in history after scan. I guess this is not about scanned files, but about date format, so if you have it in Russian (like is in my case), then something got crashed.

[dave-theunsub]

Hi,

So if you type "echo $LANG" on the terminal you get ru_RU.UTF-8?

If so, I can't duplicate this. See attached screenshot.

Can you open a terminal window and type "clamtk" (without quotes, of course), hit enter, and try running? Sometimes error messages will show up in the terminal and it could give us more information.

respectfully Dave M

[slimer12345]

No, LANG is en_US.UTF-8 always (I have English interface), but the LC_TIME is ru_RU.UTF-8 when the issue appears.

[dave-theunsub]

The command locale by itself may give us more information - try running that and see what returns. To be honest I've only ever messed with the $LANG variable to test language files and what not, so I might not be the best help for this issue.

[slimer12345]

I can do it later today (do not have Linux PC nearby now), but pretty sure that problem is in the LC_TIME specifically. So if it is possible to change it to ru_RU.UTF-8 on your side (e.g. export LC_TIME="ru_RU.UTF-8"), I believe you should be able to duplicate.

[slimer12345]

Here it goes. Locale (when issue persists): LANG=en_US.UTF-8 LANGUAGE=en_US LC_CTYPE="en_US.UTF-8" LC_NUMERIC=ru_RU.UTF-8 LC_TIME=ru_RU.UTF-8 LC_COLLATE="en_US.UTF-8" LC_MONETARY=ru_RU.UTF-8 LC_MESSAGES="en_US.UTF-8" LC_PAPER=ru_RU.UTF-8 LC_NAME=ru_RU.UTF-8 LC_ADDRESS=ru_RU.UTF-8 LC_TELEPHONE=ru_RU.UTF-8 LC_MEASUREMENT=ru_RU.UTF-8 LC_IDENTIFICATION=ru_RU.UTF-8 LC_ALL=

[slimer12345]

Tried clamtk in terminal, after scan there is this exception: unhandled exception in callback: Wide character at /usr/lib/i386-linux-gnu/perl/5.26/Encode.pm line 212. *** ignoring at /usr/share/perl5/ClamTk/GUI.pm line 145.

[dave-theunsub]

What happens if you set LC_TIME like the rest?

Edit:. Or better yet, set everything to en_US or ru_RU.

[slimer12345]

As I said earlier, if I scan with en_US locale (i.e. all is set en_US.UTF-8), then no issue observed, threats window appears Ok. So it looks the issue persists only when LC_TIME is set to something where you get "extended" characters in the date (wild guess).

[dave-theunsub]

Hmmm... I haven't come up with an answer to this yet. I'll keep researching.

[woohgit]

The solution is quite obvious, run clamtk as:

LC_ALL=en_US.UTF-8 clamtk