[clamav-users] Strange Problem with a Virus inside a rar file

Tech tech at drees-dreessen.de
Thu Jul 26 07:19:49 EDT 2018


Hi Steve,

i did the list check like you proposed i got an error telling me it 
cannot open the file as archive:

Error: doc04398120180626164812.rar: Can not open file as archive

I also checked the archive with file which returned following:

file doc04398120180626164812.rar
doc04398120180626164812.rar: RAR archive data, v37, flags: Archive 
volume, Commented, Solid, Authenticated,

Any hints on how to check if the unrar library is installed correctly?

Cheers
Drees

On 26.07.2018 12:46, Steve Basford wrote:
> On Thu, July 26, 2018 10:49 am, Tech wrote:
>
>> Last week we got a mail which contained a scr file inside a rar
>> clamav-milter let it through and saying it's clean. After that the windows
>> security essentials software on one of our clients detected the virus
>> inside the rar package.
> Hi Drees,
>
> Unrar library might not be installed correctly (from memory)
>
> or
>
> It may be a Rar v5 archive, which ClamAV can't currently unpack.
>
> see:
>
> https://bugzilla.clamav.net/show_bug.cgi?id=11959
>
> If you can load 7zip on your system.. do a list and see if it's a type Rar5:
>
> eg 7z l Swift_Copy.rar
>
> Type = Rar5
>
> or send me a sample off-list and I'll check for you.
>




More information about the clamav-users mailing list