[clamav-users] Strange Problem with a Virus inside a rar file

[Steve Basford]

On Thu, July 26, 2018 10:49 am, Tech wrote:

> Last week we got a mail which contained a scr file inside a rar
> clamav-milter let it through and saying it's clean. After that the windows
> security essentials software on one of our clients detected the virus
> inside the rar package.

Hi Drees,

Unrar library might not be installed correctly (from memory)

or

It may be a Rar v5 archive, which ClamAV can't currently unpack.

see:

https://bugzilla.clamav.net/show_bug.cgi?id=11959

If you can load 7zip on your system.. do a list and see if it's a type Rar5:

eg 7z l Swift_Copy.rar

Type = Rar5

or send me a sample off-list and I'll check for you.

-- 
Cheers,

Steve
Twitter: @sanesecurity