[Pkg-clamav-devel] Bug#515798: Bug#515798: Bug#515798: Bug#515798: clamav: clamdscan fails to connect to clamd

Sun Mar 8 12:42:58 UTC 2009

Dnia 08.03.2009 13:20 użytkownik Stephen Gran napisał :
> Please send the output of `which clamdscan`.

clamdscan comes from official package, this is not a local build for sure:

miki at menek(13:23:23)~$which clamdscan
/usr/bin/clamdscan

> The other thing I'd like to see is the output of
> 
> strace -o strace.out -ff -s 500 clamdscan /usr/local/share/eicar/eicar.com
> 
> This should only produce strace.out (clamdscan doesn't fork), but if
> there are any strace.out.* files, please send them as well.

This produced strace.out.* file each time. Below is the output of two of 
them, one is when everything is fine, one when not.

###############################################################
execve("/usr/bin/clamdscan", ["clamdscan", 
"/usr/local/share/eicar/eicar.com"], [/* 33 vars */]) = 0
brk(0)                                  = 0x8053000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f1b000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or 
directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=100355, ...}) = 0
mmap2(NULL, 100355, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f02000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/usr/lib/libz.so.1", O_RDONLY)    = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\30\0\0004\0\0\0\0248\1\0\0\0\0\0004\0 
\0\5\0(\0\34\0\33\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00004\1\00004\1\0\5\0\0\0\0\20\0\0\1\0\0\00004\1\0000D\1\0000D\1\0\350\2\0\0\354\2\0\0\6\0\0\0\0\20\0\0\2\0\0\0\0105\1\0\10E\1\0\10E\1\0\340\0\0\0\340\0\0\0\6\0\0\0\4\0\0\0P\345td\3403\1\0\3403\1\0\3403\1\0\24\0\0\0\24\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0a\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\r\0\0\0\34\0\0\0008\0\0\0\22\0\0\0\0\0\0\0_\0\0\0\0\0\0\0\0\0\0\0M\0\0\0\0\0\0\0N\0\0\0\0\0\0\0Y\0\0\0\31\0\0\0S\0\0\0\\\0\0\0A\0\0\0!\0\0\0/\0\0\0\0\0\0\0)\0\0\0+\0\0\0(\0\0\0\0\0\0\0F\0\0\0\0\0\0\0\24\0\0\0\37\0\0\0\0\0\0\0^\0\0\0c\0\0\0\7\0\0\0000\0\0\0<\0\0\0\36\0\0\0\0\0\0\0Z\0\0\0\0\0\0\0\21\0\0\0]\0\0\0'\0\0\0I\0\0\0\0\0\0\0-\0\0\0\0\0\0\0\30\0\0\0\35\0\0\0=\0\0\0\0\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004\0\0\0\33\0\0\0009\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0002\0\0\0#\0\0\0*\0\0\0\0\0\0\0\0\0\0\0:\0\0\0B\0\0\0["..., 
512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=81012, ...}) = 0
mmap2(NULL, 83740, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) 
= 0xb7eed000
mmap2(0xb7f01000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13) = 0xb7f01000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/lib/i686/cmov/libresolv.so.2", O_RDONLY) = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@!\0\0004\0\0\0\310\2\1\0\0\0\0\0004\0 
\0\10\0(\0\35\0\34\0\6\0\0\0004\0\0\0004\0\0\0004\0\0\0\0\1\0\0\0\1\0\0\5\0\0\0\4\0\0\0\3\0\0\0\370\356\0\0\370\356\0\0\370\356\0\0\23\0\0\0\23\0\0\0\4\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\365\0\0\214\365\0\0\5\0\0\0\0\20\0\0\1\0\0\0l\372\0\0l\n\1\0l\n\1\0T\7\0\0X.\0\0\6\0\0\0\0\20\0\0\2\0\0\0\0\377\0\0\0\17\1\0\0\17\1\0\340\0\0\0\340\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0004\1\0\0004\1\0\0004\1\0\0 
\0\0\0 
\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345tdl\372\0\0l\n\1\0l\n\1\0\210\5\0\0\210\5\0\0\4\0\0\0\1\0\0\0\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\10\0\0\0\235\0\0\0;\0\0\0\20\0\0\0\t\0\0\0\244RH\260<\23\340\6\200\4\24\227\221\3\366\225\2@\20\0B\201\205A\20\6\30 at A\20U\205\0B\0@\220\204\10\n\0J\0\25\4\21\200\2$\210\4\4P\220\0\2\"]\260D\4\221\t\31;\0\0\0\0\0\0\0\0\0\0\0<\0\0\0>\0\0\0?\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\0B\0\0\0C\0\0\0D\0\0\0\0\0\0\0E\0\0\0F\0\0\0\0"..., 
512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=67408, ...}) = 0
mmap2(NULL, 80068, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) 
= 0xb7ed9000
mmap2(0xb7ee9000, 8192, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7ee9000
mmap2(0xb7eeb000, 6340, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7eeb000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1\0004\0\0\0\4\207\25\0\0\0\0\0004\0 
\0\n\0(\0D\0C\0\6\0\0\0004\0\0\0004\0\0\0004\0\0\0@\1\0\0@\1\0\0\5\0\0\0\4\0\0\0\3\0\0\0\260\22\24\0\260\22\24\0\260\22\24\0\23\0\0\0\23\0\0\0\4\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0hN\25\0hN\25\0\5\0\0\0\0\20\0\0\1\0\0\0\354Q\25\0\354Q\25\0\354Q\25\0\260'\0\0\204T\0\0\6\0\0\0\0\20\0\0\2\0\0\0\234m\25\0\234m\25\0\234m\25\0\360\0\0\0\360\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0t\1\0\0t\1\0\0t\1\0\0 
\0\0\0 
\0\0\0\4\0\0\0\4\0\0\0\7\0\0\0\354Q\25\0\354Q\25\0\354Q\25\0\10\0\0\0,\0\0\0\4\0\0\0\4\0\0\0P\345td\304\22\24\0\304\22\24\0\304\22\24\0\34+\0\0\34+\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td\364Q\25\0\354Q\25\0\354Q\25\0\230\34\0\0\200\34\0\0\4\0\0\0\1\0\0\0\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\10\0\0\0\363\3\0\0\n\0\0\0\0\2\0\0\16\0\0\0\2400\20D\200 
\2\1\214\3\346\220AE\210\0\204\0\10\0A\200\0@\300\200\0\f\2\f\0\0010\0\10@\"\10\246\4\210H6l\240\0260\0&\204\200\216\4\10B$\2\f\246\244\32\6c\310\0\302 
\1\300\0R\0!\201\10\4\n  \250\24"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1413540, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7ed8000
mmap2(NULL, 1418864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 
0) = 0xb7d7d000
mmap2(0xb7ed2000, 12288, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x155) = 0xb7ed2000
mmap2(0xb7ed5000, 9840, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7ed5000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7d7c000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7d7c6b0, 
limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, 
limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7ed2000, 4096, PROT_READ)   = 0
munmap(0xb7f02000, 100355)              = 0
brk(0)                                  = 0x8053000
brk(0x8074000)                          = 0x8074000
time(NULL)                              = 1236515307
gettimeofday({1236515307, 768891}, {4294967236, 0}) = 0
stat64("/usr/local/share/eicar/eicar.com", {st_mode=S_IFREG|0444, 
st_size=68, ...}) = 0
open("/etc/clamav/clamd.conf", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=1282, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f1a000
read(3, "#Automatically Generated by clamav-base postinst\n#To 
reconfigure clamd run #dpkg-reconfigure clamav-base\n#Please read 
/usr/share/doc/clamav-base/README.Debian.gz for details\nLocalSocket 
/var/run/clamav/socket\nFixStaleSocket true\nTemporaryDirectory 
/tmp\nUser clamav\nAllowSupplementaryGroups false\nScanMail 
true\nScanArchive true\nArchiveLimitMemoryUsage 
false\nArchiveBlockEncrypted false\nMaxDirectoryRecursion 
100\nFollowDirectorySymlinks false\nFollowFileSymlinks 
false\nReadTimeout 0\nMaxThreads 10\nMaxConn"..., 4096) = 1282
read(3, ""..., 4096)                    = 0
close(3)                                = 0
munmap(0xb7f1a000, 4096)                = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 3
connect(3, {sa_family=AF_FILE, path="/var/run/clamav/socket"...}, 110) = 0
write(3, "CONTSCAN /usr/local/share/eicar/eicar.com"..., 41) = 41
dup(3)                                  = 4
fcntl64(4, F_GETFL)                     = 0x2 (flags O_RDWR)
fstat64(4, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f1a000
_llseek(4, 0, 0xbf822b24, SEEK_CUR)     = -1 ESPIPE (Illegal seek)
read(4, "/usr/local/share/eicar/eicar.com: Eicar-Test-Signature 
FOUND\n"..., 1024) = 61
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 10), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f19000
write(1, "/usr/local/share/eicar/eicar.com: Eicar-Test-Signature 
FOUND\n"..., 61) = 61
read(4, ""..., 1024)                    = 0
close(4)                                = 0
munmap(0xb7f1a000, 4096)                = 0
close(3)                                = 0
gettimeofday({1236515307, 777552}, {4294967236, 0}) = 0
write(1, "\n----------- SCAN SUMMARY -----------\n"..., 38) = 38
write(1, "Infected files: 1\n"..., 18)  = 18
write(1, "Time: 0.008 sec (0 m 0 s)\n"..., 26) = 26
exit_group(1)                           = ?
###############################################################

###############################################################
execve("/usr/bin/clamdscan", ["clamdscan", 
"/usr/local/share/eicar/eicar.com"], [/* 33 vars */]) = 0
brk(0)                                  = 0x8053000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f5a000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or 
directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=100355, ...}) = 0
mmap2(NULL, 100355, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f41000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/usr/lib/libz.so.1", O_RDONLY)    = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\30\0\0004\0\0\0\0248\1\0\0\0\0\0004\0 
\0\5\0(\0\34\0\33\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00004\1\00004\1\0\5\0\0\0\0\20\0\0\1\0\0\00004\1\0000D\1\0000D\1\0\350\2\0\0\354\2\0\0\6\0\0\0\0\20\0\0\2\0\0\0\0105\1\0\10E\1\0\10E\1\0\340\0\0\0\340\0\0\0\6\0\0\0\4\0\0\0P\345td\3403\1\0\3403\1\0\3403\1\0\24\0\0\0\24\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0a\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\r\0\0\0\34\0\0\0008\0\0\0\22\0\0\0\0\0\0\0_\0\0\0\0\0\0\0\0\0\0\0M\0\0\0\0\0\0\0N\0\0\0\0\0\0\0Y\0\0\0\31\0\0\0S\0\0\0\\\0\0\0A\0\0\0!\0\0\0/\0\0\0\0\0\0\0)\0\0\0+\0\0\0(\0\0\0\0\0\0\0F\0\0\0\0\0\0\0\24\0\0\0\37\0\0\0\0\0\0\0^\0\0\0c\0\0\0\7\0\0\0000\0\0\0<\0\0\0\36\0\0\0\0\0\0\0Z\0\0\0\0\0\0\0\21\0\0\0]\0\0\0'\0\0\0I\0\0\0\0\0\0\0-\0\0\0\0\0\0\0\30\0\0\0\35\0\0\0=\0\0\0\0\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0004\0\0\0\33\0\0\0009\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0002\0\0\0#\0\0\0*\0\0\0\0\0\0\0\0\0\0\0:\0\0\0B\0\0\0["..., 
512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=81012, ...}) = 0
mmap2(NULL, 83740, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) 
= 0xb7f2c000
mmap2(0xb7f40000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13) = 0xb7f40000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/lib/i686/cmov/libresolv.so.2", O_RDONLY) = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@!\0\0004\0\0\0\310\2\1\0\0\0\0\0004\0 
\0\10\0(\0\35\0\34\0\6\0\0\0004\0\0\0004\0\0\0004\0\0\0\0\1\0\0\0\1\0\0\5\0\0\0\4\0\0\0\3\0\0\0\370\356\0\0\370\356\0\0\370\356\0\0\23\0\0\0\23\0\0\0\4\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\365\0\0\214\365\0\0\5\0\0\0\0\20\0\0\1\0\0\0l\372\0\0l\n\1\0l\n\1\0T\7\0\0X.\0\0\6\0\0\0\0\20\0\0\2\0\0\0\0\377\0\0\0\17\1\0\0\17\1\0\340\0\0\0\340\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0004\1\0\0004\1\0\0004\1\0\0 
\0\0\0 
\0\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345tdl\372\0\0l\n\1\0l\n\1\0\210\5\0\0\210\5\0\0\4\0\0\0\1\0\0\0\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\10\0\0\0\235\0\0\0;\0\0\0\20\0\0\0\t\0\0\0\244RH\260<\23\340\6\200\4\24\227\221\3\366\225\2@\20\0B\201\205A\20\6\30 at A\20U\205\0B\0@\220\204\10\n\0J\0\25\4\21\200\2$\210\4\4P\220\0\2\"]\260D\4\221\t\31;\0\0\0\0\0\0\0\0\0\0\0<\0\0\0>\0\0\0?\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\0B\0\0\0C\0\0\0D\0\0\0\0\0\0\0E\0\0\0F\0\0\0\0"..., 
512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=67408, ...}) = 0
mmap2(NULL, 80068, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) 
= 0xb7f18000
mmap2(0xb7f28000, 8192, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf) = 0xb7f28000
mmap2(0xb7f2a000, 6340, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f2a000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or 
directory)
open("/lib/i686/cmov/libc.so.6", O_RDONLY) = 3
read(3, 
"\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260e\1\0004\0\0\0\4\207\25\0\0\0\0\0004\0 
\0\n\0(\0D\0C\0\6\0\0\0004\0\0\0004\0\0\0004\0\0\0@\1\0\0@\1\0\0\5\0\0\0\4\0\0\0\3\0\0\0\260\22\24\0\260\22\24\0\260\22\24\0\23\0\0\0\23\0\0\0\4\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0hN\25\0hN\25\0\5\0\0\0\0\20\0\0\1\0\0\0\354Q\25\0\354Q\25\0\354Q\25\0\260'\0\0\204T\0\0\6\0\0\0\0\20\0\0\2\0\0\0\234m\25\0\234m\25\0\234m\25\0\360\0\0\0\360\0\0\0\6\0\0\0\4\0\0\0\4\0\0\0t\1\0\0t\1\0\0t\1\0\0 
\0\0\0 
\0\0\0\4\0\0\0\4\0\0\0\7\0\0\0\354Q\25\0\354Q\25\0\354Q\25\0\10\0\0\0,\0\0\0\4\0\0\0\4\0\0\0P\345td\304\22\24\0\304\22\24\0\304\22\24\0\34+\0\0\34+\0\0\4\0\0\0\4\0\0\0Q\345td\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\4\0\0\0R\345td\364Q\25\0\354Q\25\0\354Q\25\0\230\34\0\0\200\34\0\0\4\0\0\0\1\0\0\0\4\0\0\0\20\0\0\0\1\0\0\0GNU\0\0\0\0\0\2\0\0\0\6\0\0\0\10\0\0\0\363\3\0\0\n\0\0\0\0\2\0\0\16\0\0\0\2400\20D\200 
\2\1\214\3\346\220AE\210\0\204\0\10\0A\200\0@\300\200\0\f\2\f\0\0010\0\10@\"\10\246\4\210H6l\240\0260\0&\204\200\216\4\10B$\2\f\246\244\32\6c\310\0\302 
\1\300\0R\0!\201\10\4\n  \250\24"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1413540, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f17000
mmap2(NULL, 1418864, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 
0) = 0xb7dbc000
mmap2(0xb7f11000, 12288, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x155) = 0xb7f11000
mmap2(0xb7f14000, 9840, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f14000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7dbb000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7dbb6b0, 
limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, 
limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7f11000, 4096, PROT_READ)   = 0
munmap(0xb7f41000, 100355)              = 0
brk(0)                                  = 0x8053000
brk(0x8074000)                          = 0x8074000
time(NULL)                              = 1236515292
gettimeofday({1236515292, 746877}, {4294967236, 0}) = 0
stat64("/usr/local/share/eicar/eicar.com", {st_mode=S_IFREG|0444, 
st_size=68, ...}) = 0
open("/etc/clamav/clamd.conf", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=1282, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0xb7f59000
read(3, "#Automatically Generated by clamav-base postinst\n#To 
reconfigure clamd run #dpkg-reconfigure clamav-base\n#Please read 
/usr/share/doc/clamav-base/README.Debian.gz for details\nLocalSocket 
/var/run/clamav/socket\nFixStaleSocket true\nTemporaryDirectory 
/tmp\nUser clamav\nAllowSupplementaryGroups false\nScanMail 
true\nScanArchive true\nArchiveLimitMemoryUsage 
false\nArchiveBlockEncrypted false\nMaxDirectoryRecursion 
100\nFollowDirectorySymlinks false\nFollowFileSymlinks 
false\nReadTimeout 0\nMaxThreads 10\nMaxConn"..., 4096) = 1282
read(3, ""..., 4096)                    = 0
close(3)                                = 0
munmap(0xb7f59000, 4096)                = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 3
connect(3, {sa_family=AF_FILE, path="/var/run/clamav/socket"...}, 110) = 0
write(3, "CONTSCAN /usr/local/share/eicar/eicar.com"..., 41) = -1 EPIPE 
(Broken pipe)
--- SIGPIPE (Broken pipe) @ 0 (0) ---
+++ killed by SIGPIPE +++
###############################################################

Original files unwrapped are here:
http://miki.menek.one.pl/strace.out.1
http://miki.menek.one.pl/strace.out.2

I hope this helps. Thank you for your help.

-- 
http://miki.menek.one.pl miki at menek.one.pl
Gadu-gadu: 2128279 Mobile: +48607345846