[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-devel
Subject:    Re: [Clamav-devel] password protected rar failure in clmascan
From:       Tomasz Kojm <tk () lodz ! tpnet ! pl>
Date:       2004-05-13 18:34:00
Message-ID: 20040513203400.47a65653 () Wierszokleta ! pl
[Download RAW message or body]

On Fri, 14 May 2004 02:23:16 +1000
Alex Cherney <alex@cher.id.au> wrote:

> Hi,
> 
> password protected rar files (rar version 2) seem to cause problems to
> 
> clamscan:
> 
> clamscan.exe error.rar
> error.rar: RAR module failure.
> error.rar: OK
> 
> ----------- SCAN SUMMARY -----------
> Known viruses: 20498
> Scanned directories: 0
> Scanned files: 1
> Infected files: 0
> Data scanned: 0.01 MB
> I/O buffer size: 131072 bytes
> Time: 0.353 sec (0 m 0 s)
> 
> An exmaple is attached, password is clamav, rar 2.90 decrypts it okay.

The "(un)store" method is not supported, that's why the internal module
reports an error and the archive can be later extracted with an external
unpacker (of course in this case (password protection) it will not be
unpacked):

zolw@Wierszokleta:/tmp$ clamscan --unrar error.rar 
/tmp/error.rar: RAR module failure.

UNRAR 3.00 freeware      Copyright (c) 1993-2002 Eugene Roshal


Extracting from /tmp/error.rar

Extracting  error.png                                                
77%
Encrypted file:  CRC failed in error.png (password incorrect ?)
Total errors: 1
(raw) /tmp/error.rar: OK

----------- SCAN SUMMARY -----------
Known viruses: 21522
Scanned directories: 1
Scanned files: 1
Infected files: 0
Data scanned: 0.01 MB
I/O buffer size: 131072 bytes
Time: 4.929 sec (0 m 4 s)

-- 
   oo    .....         Tomasz Kojm <tkojm@clamav.net>
  (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
     \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
       //\   /\              Thu May 13 20:29:20 CEST 2004

[Attachment #3 (application/pgp-signature)]
-------------------------------------------------------
This SF.Net email is sponsored by: SourceForge.net Broadband
Sign-up now for SourceForge Broadband and get the fastest
6.0/768 connection for only $19.95/mo for the first 3 months!
http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click
_______________________________________________
Clamav-devel mailing list
Clamav-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/clamav-devel

[prev in list] [next in list] [prev in thread] [next in thread]