Clamscan is killed

After an install of clamav-daemon, clamscan is apparently giving itself a SIGKILL (exit status 137) after just showing a warning that the virus data base is older than 7 days. There is no scan summary printed. If I run clamscan without using "sudo", a line with just "Killed" is also displayed just before the command finishes, producing the following output:

LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
Killed

This happens whether the directory being scanned has just an empty file or just an eicar.com.txt file.

There are other problems, for example I am not able to successfully run freshclam. It also gets killed with a SIGKILL after completing the download, but with an exit status 55.

The /var/lib/clamav directory has these files:

-rw-r--r-- 1 clamav clamav    75879 May  4 21:41 bytecode.cvd
-rw-r--r-- 1 clamav clamav 45006790 May  4 21:41 daily.cvd
-rw-r--r-- 1 clamav clamav 64720632 May  4 21:40 main.cvd
-rw------- 1 clamav clamav      884 May  5 12:47 mirrors.dat

I am running Ubuntu 14.04.2 and ClamAV 0.98.7.

In case it might be significant, I also installed the unrar package but not the rar package. When running clamscan with -v --debug options, the first messages are about not finding libclamunrar_iface, the last of which is:

LibClamAV debug: Cannot dlopen libclamunrar_iface: file not found - unrar support unavailable

Those are the only messages indicating a possible problem. Later, there are also messages:

LibClamAV debug: daily.hdb loaded
LibClamAV debug: daily.hdu skipped

followed by messages about growing a hash table, with the last displayed messages being:

LibClamAV debug: hashtab.c:Growing hashtable 0x7fedab861150, because it has exceeded maxfill, old size:16384
LibClamAV debug: hashtab.c: new capacity: 32768
LibClamAV debug: Table 0x7fedab861150 size after grow:32768
LibClamAV debug: Ignoring signature Win.Trojan.5243200
LibClamAV debug: Ignoring signature Win.Trojan.Agent-533719
LibClamAV debug: hashtab.c:Growing hashtable 0x7fedab861150, because it has exceeded maxfill, old size:32768
LibClamAV debug: hashtab.c: new capacity: 65536
LibClamAV debug: Table 0x7fedab861150 size after grow:65536
LibClamAV debug: Ignoring signature Win.Worm.Chir-1906
Killed

Solution 1:

I had a similar problem after creating a new, low-end EC2 instance.

Turns out it was running out of memory before it could load all of the signatures.

For reference, free -m was showing ~300mb of available RAM before the scan, so if you have similar results, this may be the issue.

I solved this by adding a swapfile. Here is a decent guide:

How To Add Swap on Ubuntu 14.04