tk at lodz
Apr 27, 2004, 5:59 AM
Post #6 of 7
(1119 views)
Permalink
|
On Sun, 18 Apr 2004 18:05:46 +0200
Robert Allerstorfer <roal [at] anet> wrote:
> Hi,
>
> recently, an infected mail has been sent to me, containing the virus
> inside a Rar version 2.9 archive.
>
> clamscan 0.70 does work with the shipped test virus signature inside a
> Rar 2.9 archive, with the --unrar option set, using UNRAR 3.30
> freeware:
>
> [root [at] bab root]# unrar l /usr/share/doc/clamav-0.70/test/rarfail.rar
> | sed -ne '8p'
> test1 50 64 100% 08-08-02 23:58 -rw-r--r--
> EB1C995B m3b 2.9
>
> [root [at] bab root]# clamscan --unrar
> /usr/share/doc/clamav-0.70/test/rarfail.rar/usr/share/doc/clamav-0.70
> /test/rarfail.rar: RAR module failure.
>
> UNRAR 3.30 freeware Copyright (c) 1993-2004 Eugene Roshal
>
>
> Extracting from /usr/share/doc/clamav-0.70/test/rarfail.rar
>
> Extracting test1
> OK All OK
> /tmp/clamav-5e103e1ca9a91a5c/test1: ClamAV-Test-Signature FOUND
> /usr/share/doc/clamav-0.70/test/rarfail.rar: Infected Archive FOUND
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 21129
> Scanned directories: 1
> Scanned files: 1
> Infected files: 1
> Data scanned: 0.00 MB
> I/O buffer size: 131072 bytes
> Time: 0.550 sec (0 m 0 s)
>
>
> The rar'ed virus has the following properties:
>
> [root [at] bab root]# unrar l /home/roal/mail/TRASH/viruses/RAR/info.rar |
> sed -ne '8p'
> further_information.txt
> .
> e
> xe
>
4096 794 19% 25-03-04 00:55 .....A 193FFB6C m5e 2.9
>
> (Note the many spaces within the filename, trying to hide the real
> .exe extension)
>
> Extracting it succeeds:
>
> [root [at] bab root]# unrar x -p- -y
> "/home/roal/mail/TRASH/viruses/RAR/info.rar"
> "/home/roal/mail/TRASH/viruses/RAR/"
>
> UNRAR 3.30 freeware Copyright (c) 1993-2004 Eugene Roshal
>
>
> Extracting from /home/roal/mail/TRASH/viruses/RAR/info.rar
>
> Extracting /home/roal/mail/TRASH/viruses/RAR/further_information.txt
>
.exe OK
> All OK
>
>
> Scanning the directory containg both the rar archive and its extracted
> .exe virus detects the extracted virus, but the scan fails on the rar
> (with using the --unrar option):
>
> [root [at] bab root]# clamscan --stdout --unrar
> "/home/roal/mail/TRASH/viruses/RAR"/home/roal/mail/TRASH/viruses/RAR/
> info.rar: RAR module failure.
>
> UNRAR 3.30 freeware Copyright (c) 1993-2004 Eugene Roshal
>
> Cannot open /home/roal/mail/TRASH/viruses/RAR/info.rar
> No files to extract
> (raw) /home/roal/mail/TRASH/viruses/RAR/info.rar: OK
> /home/roal/mail/TRASH/viruses/RAR/further_information.txt
>
.exe: Trojan.Downloader.Small.GY FOUND
>
> ----------- SCAN SUMMARY -----------
> Known viruses: 21129
> Scanned directories: 2
> Scanned files: 2
> Infected files: 1
> Data scanned: 0.00 MB
> I/O buffer size: 131072 bytes
> Time: 0.673 sec (0 m 0 s)
>
> Any suggestions to fix that?
Fixed in CVS.
--
oo ..... Tomasz Kojm <tkojm [at] clamav>
(\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg
\..........._ 0DCA5A08407D5288279DB43454822DC8985A444B
//\ /\ Tue Apr 27 13:43:56 CEST 2004
|
