On Tue, 15 Mar 2005 at 22:07:06 -0300, Rodrigo Barbosa wrote: > On Tue, Mar 15, 2005 at 09:06:05PM +0000, Nigel Horne wrote: > > > > # unzip -l mixed-eicar.zip > > > > Archive: mixed-eicar.zip > > > > Length Date Time Name > > > > -------- ---- ---- ---- > > > > 308 03-10-05 12:00 Test^G^[[2J^[[2;5m^[[1;31mHACKER > > > > ATTACK^[[2;25m^[[22;30m^[[3q.txt > > > > 308 03-10-05 12:00 eicarcom2.zip > > > > -------- ------- > > > > 616 2 files > > > > > > F-Prot seems to detect it correctly: > > > > As does clamAV: > > [njh@njh tmp]$ clamscan mixed-eicar.zip > > mixed-eicar.zip: Eicar-Test-Signature FOUND > > > > Scanned files: 1 > > Infected files: 1 > > Actually, no. There were 2 infected files in there. ClamAV only found 1. > > - -- > Rodrigo Barbosa <rodrigob@xxxxxxxxxxxxxxx> It's a feature. It's documented, e.g.: http://www.clamav.net/doc/latest/html/node28.html "In case of archives the scanner depends on libclamav and only prints the first virus found within an archive". Scanning the rest of files in the archive when it's already known that it contains at least one infected file is usually just waste of resources. Of course it's possible to force clamscan to do it, but it's not a default way. See the URL above. Also, the number shown in "Scanned files:" means the number of files scanned directly (in this example: the archive itself), not the number of files present inside the archive. As a proof that ClamAV successfully detects the Eicar signature in zipped file with escape sequences in the filename, you can delete the eicarcom2.zip from the archive and scan the archive again: $ unzip -l mixed-eicar.zip Archive: mixed-eicar.zip Length Date Time Name -------- ---- ---- ---- 308 03-10-05 12:00 Test^G^[[2J^[[2;5m^[[1;31mHACKER ATTACK^[[2;25m^[[22;30m^[[3q.txt -------- ------- 308 1 file $ clamscan mixed-eicar.zip mixed-eicar.zip: Eicar-Test-Signature FOUND P.S. I'm not subscribed to full-disclosure, so please Cc: me in case the thread continues on full-disclosure. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only tomek at lodz.tpsa.pl http://www.lodz.tpsa.pl/iso/ | ones and zeros. tomek at clamav.net http://www.ClamAV.net/ A GPL virus scanner
