Why Does MetaDefender Core Show a 'Calculate hash error' When Scanning Malicious Files?

Issue

When testing the upload of a malicious file to MetaDefender Core, the system unexpectedly allows the file and displays the following error during scanning:

Archive Extraction: Extraction error Extraction Result Failure Category: Calculate hash error Error Details: Can't get fileinfo to calculate hash: 'Can't open file for reading'

Root Cause

The error occurs because local antivirus software on the system is detecting and handling the malware file before MetaDefender Core can access it. As a result, MetaDefender Core is unable to read the file and generate the necessary hash for scanning.

This typically happens when Real-Time Protection (RTP) is enabled on the local antivirus, causing the file to be quarantined or blocked immediately after upload.

Solution

To resolve this issue, you need to disable RTP or add exclusions for MetaDefender Core directories in your local antivirus software.

Recommended Steps:

1. Disable Real-Time Protection (RTP)

• This can usually be done through your antivirus software’s settings panel.

OR

2. Add Exclusions in Antivirus Software:

• Exclude the following directories from real-time scanning:
  • C:\Program Files\OPSWAT
  • C:\Users<YourUsername>\AppData\Local\Temp

Replace <YourUsername> with the actual Windows username running the MetaDefender Core service.

3. Exclude specific processes:

• On Windows: “engineprocess.exe”, “engineprocess32.exe”, “ometascan.exe”, “postgres.exe” and “nginx.exe” processes.
• On Linux: “engineprocess”, “ometascan”, “postgres” and “nginx” processes.