... | ... |
@@ -64,7 +64,7 @@ enum CLAM_SCAN_OPTIONS { |
64 | 64 |
/* CLAMAPI SCAN PHASES */ |
65 | 65 |
/* Define the scan phase to which the returned results refer to */ |
66 | 66 |
typedef enum _CLAM_SCAN_PHASE { |
67 |
- SCAN_PHASE_INITIAL, /* ight before ClamAV starts scanning the entry (outer) file - in scan callback mode only */ |
|
67 |
+ SCAN_PHASE_INITIAL, /* Right before ClamAV starts scanning the entry (outer) file - in scan callback mode only */ |
|
68 | 68 |
SCAN_PHASE_PRESCAN, /* Right before ClamAV starts scanning the current file - in scan callback mode only */ |
69 | 69 |
SCAN_PHASE_POSTSCAN, /* After ClamAV has scanned the current file - in scan callback mode only */ |
70 | 70 |
SCAN_PHASE_FINAL /* After ClamAV has scanned the entry (outer) file (callback) and upon returning from ScanObject */ |
... | ... |
@@ -529,6 +529,40 @@ int CLAMAPI Scan_ScanObjectByHandle(CClamAVScanner *pScanner, HANDLE object, int |
529 | 529 |
logg("Scan_ScanObjectByHandle (instance %p) invoking cl_scandesc with clamav context %p\n", inst, &sctx); |
530 | 530 |
perf = GetTickCount(); |
531 | 531 |
res = cl_scandesc_callback(fd, &virname, NULL, engine, inst->scanopts, &sctx); |
532 |
+ |
|
533 |
+ do { |
|
534 |
+ CLAM_SCAN_INFO si; |
|
535 |
+ CLAM_ACTION act; |
|
536 |
+ HANDLE fdhdl; |
|
537 |
+ DWORD cbperf; |
|
538 |
+ wchar_t wvirname[MAX_VIRNAME_LEN]; |
|
539 |
+ LONG lo = 0, hi = 0, hi2 = 0; |
|
540 |
+ |
|
541 |
+ si.cbSize = sizeof(si); |
|
542 |
+ si.flags = 0; |
|
543 |
+ si.scanPhase = SCAN_PHASE_FINAL; |
|
544 |
+ si.errorCode = CLAMAPI_SUCCESS; |
|
545 |
+ if(res == CL_VIRUS) { |
|
546 |
+ if(MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, virname, -1, wvirname, MAX_VIRNAME_LEN)) |
|
547 |
+ si.pThreatName = wvirname; |
|
548 |
+ else |
|
549 |
+ si.pThreatName = L"INFECTED"; |
|
550 |
+ } else |
|
551 |
+ si.pThreatName = NULL; |
|
552 |
+ logg("in final_cb with clamav context %p, instance %p, fd %d, result %d, virusname %S)\n", &sctx, inst, fd, res, si.pThreatName); |
|
553 |
+ si.pThreatType = threat_type(virname); |
|
554 |
+ si.object = duphdl; |
|
555 |
+ si.pInnerObjectPath = NULL; |
|
556 |
+ lo = SetFilePointer(duphdl, 0, &hi, FILE_CURRENT); |
|
557 |
+ SetFilePointer(duphdl, 0, &hi2, FILE_BEGIN); |
|
558 |
+ logg("final_cb (clamav context %p, instance %p) invoking callback %p with context %p\n", &sctx, inst, inst->scancb, inst->scancb_ctx); |
|
559 |
+ cbperf = GetTickCount(); |
|
560 |
+ inst->scancb(&si, &act, inst->scancb_ctx); |
|
561 |
+ cbperf = GetTickCount() - cbperf; |
|
562 |
+ logg("final_cb (clamav context %p, instance %p) callback completed with %u (result ignored) in %u ms\n", &sctx, inst, act, cbperf); |
|
563 |
+ SetFilePointer(duphdl, lo, &hi, FILE_BEGIN); |
|
564 |
+ } while(0); |
|
565 |
+ |
|
532 | 566 |
perf = GetTickCount() - perf; |
533 | 567 |
close(fd); |
534 | 568 |
logg("Scan_ScanObjectByHandle (instance %p): cl_scandesc returned %d in %u ms\n", inst, res, perf); |
... | ... |
@@ -656,10 +690,13 @@ cl_error_t postscan_cb(int fd, int result, const char *virname, void *context) { |
656 | 656 |
logg("!postscan_cb called with NULL clamav context\n"); |
657 | 657 |
return CL_CLEAN; |
658 | 658 |
} |
659 |
+ if(fd == sctx->entryfd) |
|
660 |
+ return CL_CLEAN; /* Moved to after cl_scandesc returns due to heuristic results not being yet set in magicscan */ |
|
661 |
+ |
|
659 | 662 |
inst = sctx->inst; |
660 | 663 |
si.cbSize = sizeof(si); |
661 | 664 |
si.flags = 0; |
662 |
- si.scanPhase = (fd == sctx->entryfd) ? SCAN_PHASE_FINAL : SCAN_PHASE_POSTSCAN; |
|
665 |
+ si.scanPhase = SCAN_PHASE_POSTSCAN; |
|
663 | 666 |
si.errorCode = CLAMAPI_SUCCESS; |
664 | 667 |
if(result == CL_VIRUS) { |
665 | 668 |
if(MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, virname, -1, wvirname, MAX_VIRNAME_LEN)) |
... | ... |
@@ -678,7 +715,7 @@ cl_error_t postscan_cb(int fd, int result, const char *virname, void *context) { |
678 | 678 |
perf = GetTickCount(); |
679 | 679 |
inst->scancb(&si, &act, inst->scancb_ctx); |
680 | 680 |
perf = GetTickCount() - perf; |
681 |
- logg("prescan_cb (clamav context %p, instance %p) callback completed in %u ms\n", context, inst, act); |
|
681 |
+ logg("postscan_cb (clamav context %p, instance %p) callback completed with %u in %u ms\n", context, inst, act, perf); |
|
682 | 682 |
SetFilePointer(fdhdl, lo, &hi, FILE_BEGIN); |
683 | 683 |
switch(act) { |
684 | 684 |
case CLAM_ACTION_SKIP: |