That one is definitely a bug. Since you&#39;re using a source distribution, can you apply the patch below (also attached as a file in case that&#39;s easier) and let me know if its resolved?<div><br></div><div>-MHL<br><div>
<br></div><div><div>Index: volatility/plugins/malware/malfind.py</div><div>===================================================================</div><div>--- volatility/plugins/malware/malfind.py<span class="Apple-tab-span" style="white-space:pre">	</span>(revision 2641)</div>
<div>+++ volatility/plugins/malware/malfind.py<span class="Apple-tab-span" style="white-space:pre">	</span>(working copy)</div><div>@@ -562,7 +562,7 @@</div><div>                 # vad region and then checking the first two bytes. </div>
<div>                 if obj.Object(&quot;_IMAGE_DOS_HEADER&quot;, offset = vad.Start, vm = address_space).e_magic != 0x5A4D:</div><div>                     continue</div><div>-                mapped_files[int(vad.Start)] = vad.FileObject.FileName</div>
<div>+                mapped_files[int(vad.Start)] = str(vad.FileObject.FileName or &#39;&#39;)</div><div> </div><div>             # For each base address with a mapped file, print info on </div><div>             # the other PEB lists to spot discrepancies. </div>
<div><br></div><div><br><div class="gmail_quote">On Thu, Oct 4, 2012 at 5:31 PM, David Kovar <span dir="ltr">&lt;<a href="mailto:dkovar@gmail.com" target="_blank">dkovar@gmail.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Greetings,<br>
<br>
Same install, new error:<br>
<br>
vol.py -f *.mem --profile=Win2003SP2x86 --kdbg=0x808943e0 --dtb=0x1595000 ldrmodules<br>
<br>
&lt;lots of valid output, then....&gt;<br>
<br>
Traceback (most recent call last):<br>
  File &quot;/usr/local/bin/vol.py&quot;, line 5, in &lt;module&gt;<br>
    pkg_resources.run_script(&#39;volatility==2.2&#39;, &#39;vol.py&#39;)<br>
  File &quot;/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py&quot;, line 489, in run_script<br>
    self.require(requires)[0].run_script(script_name, ns)<br>
  File &quot;/System/Library/Frameworks/Python.framework/Versions/2.7/Extras/lib/python/pkg_resources.py&quot;, line 1207, in run_script<br>
    execfile(script_filename, namespace, namespace)<br>
  File &quot;/Library/Python/2.7/site-packages/volatility-2.2-py2.7.egg/EGG-INFO/scripts/vol.py&quot;, line 186, in &lt;module&gt;<br>
    main()<br>
  File &quot;/Library/Python/2.7/site-packages/volatility-2.2-py2.7.egg/EGG-INFO/scripts/vol.py&quot;, line 177, in main<br>
    command.execute()<br>
  File &quot;/Library/Python/2.7/site-packages/volatility-2.2-py2.7.egg/volatility/commands.py&quot;, line 111, in execute<br>
    func(outfd, data)<br>
  File &quot;/Library/Python/2.7/site-packages/volatility-2.2-py2.7.egg/volatility/plugins/malware/malfind.py&quot;, line 582, in render_text<br>
    mapped_files[base]<br>
  File &quot;/Library/Python/2.7/site-packages/volatility-2.2-py2.7.egg/volatility/commands.py&quot;, line 201, in table_row<br>
    result = self._elide((&quot;{0:&quot; + spec.to_string() + &quot;}&quot;).format(args[index]), spec.minwidth)<br>
UnicodeEncodeError: &#39;ascii&#39; codec can&#39;t encode character u&#39;\ufffd&#39; in position 0: ordinal not in range(128)<br>
<br>
-David<br>
<br>
_______________________________________________<br>
Vol-users mailing list<br>
<a href="mailto:Vol-users@volatilityfoundation.org">Vol-users@volatilesystems.com</a><br>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a><br>
</blockquote></div><br></div></div></div>