OrchardCMS/OrchardCore · error · AntivirusScanningException

The ClamAV antivirus scanner returned an unexpected…

Error message

The ClamAV antivirus scanner returned an unexpected response while scanning '{context.FileName}': {response}

What it means

TryCreateFailureResult parses the raw response line from clamd. Only "stream: OK" and "... FOUND" (virus detected) are recognized; anything else causes this AntivirusScanningException, so an unrecognized daemon reply fails the upload instead of being silently accepted.

Solutions

Inspect the message's {response} value to see the actual daemon reply.
If it is "INSTREAM size limit exceeded", raise clamd's StreamMaxLength and the app-side limits.
Ensure the endpoint truly is a clamd INSTREAM listener (correct port, no HTTP proxy in the path).
Align clamd and OrchardCore.ClamAV versions/protocol expectations.

Example fix

# before (clamd.conf)
StreamMaxLength 10M
# after
StreamMaxLength 100M

Defensive patterns

Strategy: try-catch

Try / catch

try
{
    await UploadFileAsync(stream);
}
catch (AntivirusScanningException ex) when (ex.Message.Contains("unexpected response"))
{
    // read ex.Message after ':' to inspect the raw clamd reply and act on it
}

Prevention

Set clamd StreamMaxLength above your max upload to avoid 'size limit exceeded' replies.
Point the app directly at clamd (no HTTP proxies in between).
Keep the ClamAV module and clamd versions compatible.
Test with a known-clean file after any clamd config change.

When it happens

Trigger: The ClamAV daemon returns a response that is neither "stream: OK" nor ends with " FOUND" — e.g. "INSTREAM size limit exceeded. ERROR", an error string, or a protocol-level message from an incompatible clamd version.

Common situations: Upload exceeds clamd's StreamMaxLength (returns "size limit exceeded"), clamd misconfigured to reply in a different format, a proxy/load balancer injecting its own response, or clamd version mismatch.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/088956c602ff2316. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Antivirus/ClamAV/ClamAvFileEventHandler.cs:156

            var signature = response;
            var separatorIndex = signature.IndexOf(": ", StringComparison.Ordinal);

            if (separatorIndex >= 0)
            {
                signature = signature[(separatorIndex + 2)..];
            }

            signature = signature[..^" FOUND".Length];

            stream.Position = 0;

            return FileCreatingResult.Failed(stream, new ResultError
            {
                Message = new LocalizedString(nameof(ClamAvFileEventHandler), $"The uploaded file '{context.FileName}' was rejected because ClamAV detected '{signature}'."),
            });
        }

        throw new AntivirusScanningException(
            $"The ClamAV antivirus scanner returned an unexpected response while scanning '{context.FileName}': {response}");
    }

    private void ValidateOptions()
    {
        if (string.IsNullOrWhiteSpace(_options.Host))
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the host setting is missing.");
        }

        if (_options.Port is < 1 or > 65535)
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the port setting is invalid.");
        }

        if (_options.ConnectTimeoutSeconds <= 0)
        {
            throw new AntivirusScanningException("The ClamAV antivirus scanner is enabled but the connection timeout must be greater than zero.");

View on GitHub (pinned to 4306c0717f)