I am exploring the addon GitHub - fegorama/alfviral: Alfresco Virus Alert
I am using the COMMAND mode to scan the files for virus.I have the following configuration in alfviral.properties file.
alfviral.mode=COMMAND
alfviral.command.exec=/usr/bin/clamscan
When the following code is executed
ProcessBuilder pb = new ProcessBuilder(this.command);
Process process = pb.start();
res = process.waitFor();
logger.debug(" ++++++the value of res is++++++++"+res);
and uploaded a file of mimetype application/x-dosexec,I got the following logs
2018-03-07 19:12:38,753 DEBUG com.fegor.alfresco.services.AntivirusServiceImpl: [Type: application/x-dosexec]
com.fegor.alfresco.services.AntivirusServiceImpl: [Mode: COMMAND]
2018-03-07 19:12:38,753 DEBUG [security.antivirus.CommandScan] [http-apr-8080-exec-10] ++++++the value of res is++++++++127
So,when I have done a little bit of googling,I have understood that 127 is a special exit code which means that the command is not found.
I am surprised that logs are showing that the command is not found because when I have directly run the clamscan on a file,it is working perfectly and showing that the file is infected if the file is infected and clean if the file is not infected.
ayushi@ayushi-GA-78LMT-S2PT:~$ clamscan ~/Downloads/stepup.exe
/home/ayushi/Downloads/stepup.exe: OK
----------- SCAN SUMMARY -----------
Known viruses: 6431792
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 9.14 MB
Data read: 2.46 MB (ratio 3.72:1)
Time: 13.816 sec (0 m 13 s)
Also,when I have scanned the file with virustotal mode,it is working perfectly.
