dutchcoders/transfer.sh · warning

Clamav prescan found a virus

Error message

Clamav prescan found a virus

What it means

In postHandler, when the server runs with ClamAV prescan enabled (ClamavPort configured), each uploaded multipart part is written to a temp file and scanned via performScan before storage. If the ClamAV daemon reports any status other than OK, the server rejects the upload with HTTP 412 Precondition Failed and this message. It is an intentional server-side antivirus policy rejection, not a crash.

Source

Thrown at server/handlers.go:512

			}

			if s.maxUploadSize > 0 && contentLength > s.maxUploadSize {
				s.logger.Print("Entity too large")
				http.Error(w, http.StatusText(http.StatusRequestEntityTooLarge), http.StatusRequestEntityTooLarge)
				return
			}

			if s.performClamavPrescan {
				status, err := s.performScan(file.Name())
				if err != nil {
					s.logger.Printf("%s", err.Error())
					http.Error(w, "Could not perform prescan", http.StatusInternalServerError)
					return
				}

				if status != clamavScanStatusOK {
					s.logger.Printf("prescan positive: %s", status)
					http.Error(w, "Clamav prescan found a virus", http.StatusPreconditionFailed)
					return
				}
			}

			metadata := metadataForRequest(contentType, contentLength, s.randomTokenLength, r)

			buffer := &bytes.Buffer{}
			if err := json.NewEncoder(buffer).Encode(metadata); err != nil {
				s.logger.Printf("%s", err.Error())
				http.Error(w, "Could not encode metadata", http.StatusInternalServerError)

				return
			} else if err := s.storage.Put(r.Context(), token, fmt.Sprintf("%s.metadata", filename), buffer, "text/json", uint64(buffer.Len())); err != nil {
				s.logger.Printf("%s", err.Error())
				http.Error(w, "Could not save metadata", http.StatusInternalServerError)

				return
			}

View on GitHub (pinned to c37bfd9579)

Solutions

1. Remove the virus signature or stop uploading the flagged file; the rejection is by design.
2. Verify with `clamscan <file>` locally whether the detection is a true positive or a false positive.
3. If it is a false positive, update ClamAV virus definitions (freshclam) or submit a false-positive report to ClamAV.
4. As an operator, disable prescan (unset the ClamAV port option) if the security policy allows unscanned uploads.
5. Handle HTTP 412 in the client by surfacing the antivirus rejection to the end user instead of retrying.

Example fix

// before: blindly retrying the upload
resp, _ := http.Post(url, "application/octet-stream", file)
// after: detect the 412 antivirus rejection and inform the user
resp, _ := http.Post(url, "application/octet-stream", file)
if resp != nil && resp.StatusCode == http.StatusPreconditionFailed {
    return fmt.Errorf("upload rejected: file failed ClamAV prescan")
}

// Scan locally with clamscan before uploading
func passesPrescan(path string) bool {
    out, err := exec.Command("clamscan", "--no-summary", path).Output()
    if err != nil {
        return false // clamscan exits non-zero when a virus is found
    }
    _ = out
    return true
}

resp, err := http.Post(url, mime, body)
if err == nil && resp.StatusCode == http.StatusPreconditionFailed {
    return fmt.Errorf("upload rejected by server antivirus prescan")
}

When it happens

Trigger: POST a multipart upload to the server while the operator has ClamAV prescan enabled and the uploaded file matches a ClamAV signature (EICAR test string, actual malware, or a false-positive signature).

Common situations: Uploading EICAR test files during integration testing; hosting scenarios where users share binaries or documents that trip heuristic ClamAV signatures; security-sensitive deployments (public file-sharing instances) that routinely reject flagged content.

Related errors

• Could not crypt file
• clamav scan timeout
• Could not encode metadata
• Could not save metadata
• clamav-host not set

AI-assisted analysis of dutchcoders/transfer.sh@c37bfd9579 (2026-09-05). Data as JSON: /api/errors/8aff3122e3520e74. Report an issue: GitHub.