[Avcheck] drweb errors

Michael Tokarev mjt@tls.msk.ru
Wed, 03 Apr 2002 15:44:42 +0400


liedekef@pandora.be wrote:
> 
> Hi all,
> 
> I'm using drweb with avcheck for almost 2 weeks now, almost without
> problems. I do have problems though:
> 
> 1) sometimes I see in /var/spool/drweb/run/log the following lines:
> 
>    /tst/4069.tmp/Chloe jones.pps - read error!
>    /tst/17130.tmp/020402SpEekloActieveBurgers.doc - read error!
> 
>    Does anybody know a reason for these?

DrWeb treats invalid structure of .doc, .xls etc files as read errors.
Avcheck just ignores this condition as a workaround (there is no harm
if *real* read error will happen since it will be seen by avcheck too).
This is a known behaviour -- not to say correct but known.

> 2) Sometimes people get a mailer-daemon with the following error message:
> 
>  <liedekef@pandora.be> temporary failure. Command output: avcheck:
>     unexpected DrWeb return code 16384 (0x4000)

0x4000 means that a file compression rate is too high.  Avcheck-0.8
(still not announced but released a long time ago) rejects such mails
like infected.  You may also try to play some games with MaxCompressionRatio
in drweb.ini.

> Now maybe this error is related to the first problem?

No.

>   But I would
> suggest that, in case of unexpected return codes, avcheck lets the mail go
> through...

I thought about that too.  But in any case, avcheck should not see any
*unexpected* codes (0x4000 code should be one of expected as it is in 0.8).
Any *unexpected* code means that something is wrong with setup and should
be repaired.

> I'm running avcheck 0.7 with Drweb 4.27, updated to the latest drweb32.dll
> (I don't know if I need to restart drweb for the new dll though, I just
> gave it a HUP)

I think that in order to "reread" .dll, drwebd should be restarted.

Regards,
 Michael.