Antivirus message "Unknown error

blacksteel1288 · August 18, 2020, 10:03pm

Nextcloud version (eg, 18.0.2) : 19.0.1
Operating system and version (eg, Ubuntu 20.04) : FreeBSD 11.3
Apache or nginx version (eg, Apache 2.4.25) : nginx 1.18.0_20,2
PHP version (eg, 7.1) : 7.4

I’m running the antivirus app connected to a ClamAV server. When I upload the EICAR test file, the popup error message just says “An unknown error has occurred.” Is there a way to have it say something more descriptive like “A virus was found in your upload.”?

I tried the default config and also tried editing the text in the rules in “Advanced” section of the settings for antivirus, but it still shows the same ‘unknown error’ message to the end user either way.

In the logs, I can see the antivirus detected the eicar test file correctly and blocked it, so I know it is working.

I suspect this might be a bug in antivirus but thought I’d check to see if anyone has got this to work correctly?

j-ed · August 19, 2020, 6:55am

I would assume that additional information could be found in the Nextcloud log file. Can you please post the scan related log lines here?

blacksteel1288 · August 20, 2020, 12:57am

{"reqId":"WPuk34SWUklP2f9TLpkf","level":2,"time":"2020-08-19T20:52:01-04:00","remoteAddr":"192.168.1.163","user":"[username]","app":"files_antivirus","method":"PUT","url":"/remote.php/webdav/shared/temp/eicar.com.txt","message":"Infected file deleted. Eicar-Test-Signature Account: [username] Path: temp/eicar.com.txt.ocTransferId1210386834.part","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36","version":"19.0.1.1"}
{"reqId":"WPuk34SWUklP2f9TLpkf","level":4,"time":"2020-08-19T20:52:01-04:00","remoteAddr":"192.168.1.163","user":"[username]","app":"files_antivirus","method":"PUT","url":"/remote.php/webdav/shared/temp/eicar.com.txt","message":"Infected file deleted. Eicar-Test-Signature File: temp/eicar.com.txt.ocTransferId1210386834.part Account: [username]","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36","version":"19.0.1.1"}
{"reqId":"WPuk34SWUklP2f9TLpkf","level":3,"time":"2020-08-19T20:52:01-04:00","remoteAddr":"192.168.1.163","user":"[username]","app":"no app in context","method":"PUT","url":"/remote.php/webdav/shared/temp/eicar.com.txt","message":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Eicar-Test-Signature is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/usr/local/www/nextcloud/apps-pkg/files_external/3rdparty/icewind/streams/src/CallbackWrapper.php","line":121,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Common.php","line":867,"function":"fclose","args":[null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Common","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/apps/files_antivirus/lib/AvirWrapper.php","line":94,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/File.php","line":202,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/Directory.php","line":154,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1104,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["eicar.com.txt",null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":527,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["shared/temp/eicar.com.txt",null,null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":474,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:PUT",[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php","line":82,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/remote.php","line":167,"args":["/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps/files_antivirus/lib/AvirWrapper.php","Line":154,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36","version":"19.0.1.1"}
{"reqId":"WPuk34SWUklP2f9TLpkf","level":4,"time":"2020-08-19T20:52:01-04:00","remoteAddr":"192.168.1.163","user":"[username]","app":"webdav","method":"PUT","url":"/remote.php/webdav/shared/temp/eicar.com.txt","message":{"Exception":"OCA\\DAV\\Connector\\Sabre\\Exception\\UnsupportedMediaType","Message":"Virus Eicar-Test-Signature is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/File.php","line":252,"function":"convertToSabreException","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[{"__class__":"OCP\\Files\\InvalidContentException"}]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/Directory.php","line":154,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1104,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["eicar.com.txt",null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":527,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["shared/temp/eicar.com.txt",null,null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":474,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:PUT",[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php","line":82,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/remote.php","line":167,"args":["/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/File.php","Line":644,"Previous":{"Exception":"OCP\\Files\\InvalidContentException","Message":"Virus Eicar-Test-Signature is detected in the file. Upload cannot be completed.","Code":0,"Trace":[{"function":"OCA\\Files_Antivirus\\{closure}","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/usr/local/www/nextcloud/apps-pkg/files_external/3rdparty/icewind/streams/src/CallbackWrapper.php","line":121,"function":"call_user_func","args":[{"__class__":"Closure"}]},{"function":"stream_close","class":"Icewind\\Streams\\CallbackWrapper","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Common.php","line":867,"function":"fclose","args":[null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Common","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/apps/files_antivirus/lib/AvirWrapper.php","line":94,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":631,"function":"writeStream","class":"OCA\\Files_Antivirus\\AvirWrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null,null]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/File.php","line":202,"function":"writeStream","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->","args":["temp/eicar.com.txt.ocTransferId1210386834.part",null]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/lib/Connector/Sabre/Directory.php","line":154,"function":"put","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->","args":[null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":1104,"function":"createFile","class":"OCA\\DAV\\Connector\\Sabre\\Directory","type":"->","args":["eicar.com.txt",null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":527,"function":"createFile","class":"Sabre\\DAV\\Server","type":"->","args":["shared/temp/eicar.com.txt",null,null]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpPut","class":"Sabre\\DAV\\CorePlugin","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":474,"function":"emit","class":"Sabre\\DAV\\Server","type":"->","args":["method:PUT",[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->","args":[{"__class__":"Sabre\\HTTP\\Request"},{"__class__":"Sabre\\HTTP\\Response"}]},{"file":"/usr/local/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php","line":82,"function":"exec","class":"Sabre\\DAV\\Server","type":"->","args":[]},{"file":"/usr/local/www/nextcloud/remote.php","line":167,"args":["/usr/local/www/nextcloud/apps-pkg/dav/appinfo/v1/webdav.php"],"function":"require_once"}],"File":"/usr/local/www/nextcloud/apps/files_antivirus/lib/AvirWrapper.php","Line":154},"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36","version":"19.0.1.1"}

j-ed · August 20, 2020, 7:16am

Ok, the scan itself seems to work. In which mode are you running the app, application, daemon or daemon (socket)?

blacksteel1288 · August 20, 2020, 6:32pm

This is set to “Daemon”, because the ClamAV server is remote – it is connecting on port 3310.

I can verify on the ClamAV server logs that it is detecting the virus file correctly also.

j-ed · August 21, 2020, 8:47am

That’s strange, I’m using the “damon (socket)” mode which should return the same granular answer as if using the “daemon” mode. Only setting the mode to “application” could change the result from my understanding because the return codes so detailed as if using the program daemon.