gurlchecker doesn't find EICAR virus using libclamav5

Binary package hint: gurlchecker

Ubuntu version: Ubuntu 8.10
gnuchecker version: 0.10.2-2build1
libclamav5: 0.94.dfsg.2-1ubuntu0.1

Install gnuchecker with apt-get, install clamav, update database with freshclam.

- start gnuchecker
- go to 'Edit / Preferences / Debug' and check the two option boxes
- go to 'Filters / Documents' and check 'Retrieve content of non HTML files'
- go to 'Security' and check 'Activate security checks', deactivate 'Files' and activate 'Virii' (libclamav), leave all boxes checked
- click Apply, then OK
- go to 'Project / New Project / Web site' (or press F1), enter the following URL: http://www.eicar.org/anti_virus_test_file.htm, press OK
- wait for the scan (if started from a terminal, one should see a lot of debug output)

The problem: it doesn't find the EICAR test virus using libclamav database. gurlchecker shows the site is OK, it doesn't mention anything about a virus being in the eicar_com.zip file for example. If one downloads the file separately and scans with clamscan, it would found the test signature, like this:

gimre@voy:~$ cd /tmp
gimre@voy:/tmp$ wget -q http://www.eicar.org/download/eicar_com.zip
gimre@voy:/tmp$ wget -q http://www.eicar.org/download/eicar.com.txt
gimre@voy:/tmp$ clamscan eicar*
eicar.com.txt: Eicar-Test-Signature FOUND
eicar_com.zip: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 505429
Engine version: 0.94.2
Scanned directories: 0
Scanned files: 2
Infected files: 2 <-- !
Data scanned: 0.00 MB
Time: 3.978 sec (0 m 3 s)

Because the gurlchecker is using the same libclamav engine, one would expect it to find the 'virus' (as do dansguardian and havp, using the same libclamav).

After further investigating, it seems gurlchecker doesn't even download the .zip file correctly in it's cache (~/user/.gurlchecker/cache/gurlchecker_<pid>/*). Here's the debug output from the console:

DEBUG: (200) http://www.eicar.org/download/eicar_com.zip

        uid: 19
        current_path: /anti_virus_test_file.htm
        link_type: 1
        link_value: http://www.eicar.org/download/eicar_com.zip
        url: http://www.eicar.org/download/eicar_com.zip
        normalized_url: (null)
        label: eicar_com.zip
        protocol: http
        h_name: www.eicar.org
        port: 80
        path: /download/eicar_com.zip
        args:
        domain:
        header_size: 366
        depth_level: 0
        is_parsable: 0
        is_downloadable: 1
        checked: 0
        to_delete: 0
        metas: 0
        emails: 0
        childs: 0
        similar_links_parents: 0
        bad_extensions: 0
        virii: 0
        w3c_valid: 1
DEBUG: [SECURITY] Scanning /home/gimre/.gurlchecker/cache/gurlchecker_14970/19 for virii...

It does check for viruses, but it doesn't find anything because it's not downloaded entirely:

gimre@voy:~$ ls -la /home/gimre/.gurlchecker/cache/gurlchecker_14970/19
-rw-r--r-- 1 gimre gimre 5 2009-02-03 23:35 /home/gimre/.gurlchecker/cache/gurlchecker_14970/19

It's 5 bytes, instead of 184 bytes.

The .com file is downloaded correctly:

DEBUG: (200) http://www.eicar.org/download/eicar.com

        uid: 17
        current_path: /anti_virus_test_file.htm
        link_type: 1
        link_value: http://www.eicar.org/download/eicar.com
        url: http://www.eicar.org/download/eicar.com
        normalized_url: (null)
        label: eicar.com
        protocol: http
        h_name: www.eicar.org
        port: 80
        path: /download/eicar.com
        args:
        domain:
        header_size: 377
        depth_level: 0
        is_parsable: 0
        is_downloadable: 1
        checked: 0
        to_delete: 0
        metas: 0
        emails: 0
        childs: 0
        similar_links_parents: 0
        bad_extensions: 0
        virii: 0
        w3c_valid: 1

but it doesn't get checked, although it contains the virus too:

gimre@voy:~$ clamscan /home/gimre/.gurlchecker/cache/gurlchecker_14970/17
/home/gimre/.gurlchecker/cache/gurlchecker_14970/17: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 505429
Engine version: 0.94.2
Scanned directories: 0
Scanned files: 1
Infected files: 1 <-- !
Data scanned: 0.00 MB
Time: 3.965 sec (0 m 3 s)

Here's the content of the .zip cache file:

gimre@voy:~$ cat -v /home/gimre/.gurlchecker/cache/gurlchecker_14970/19
PK^C^D

Expected behaviour: to download the zip file, find the virus and report it.
Current behaviour: it doesn't report anything, not on the zip file, not on the .txt file or .com file.