[clamav-users] unexplainable tar behaviour

Steffen Sledz sledz at dresearch-fe.de
Wed Oct 30 03:19:25 EDT 2019


On 29.10.19 15:10, Alan Stern wrote:
> Try bisection...

That makes things even more confusing.

I have shared the tar twice with different ratios. But the individual parts are all reported as clean.

# split -b 80M all.tar all
# ll
total 445768
-rw-r--r--  1 root root  83886080 30. Okt 07:57 allaa
-rw-r--r--  1 root root  80998400 30. Okt 07:57 allab
-rw-r--r--  1 root root 164884480 29. Okt 08:00 all.tar
# clamdscan  -v --fdpass all*
/root/clamcheck/allaa: OK
/root/clamcheck/allab: OK
/root/clamcheck/all.tar: Java.Trojan.Agent-36975 FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 40.302 sec (0 m 40 s)

# split -b 77M all.tar all
# ll
total 445768
-rw-r--r--  1 root root  80740352 30. Okt 08:15 allaa
-rw-r--r--  1 root root  80740352 30. Okt 08:15 allab
-rw-r--r--  1 root root   3403776 30. Okt 08:15 allac
-rw-r--r--  1 root root 164884480 29. Okt 08:00 all.tar
# clamdscan  -v --fdpass all*
/root/clamcheck/allaa: OK
/root/clamcheck/allab: OK
/root/clamcheck/allac: OK
/root/clamcheck/all.tar: Java.Trojan.Agent-36975 FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 41.426 sec (0 m 41 s)


More information about the clamav-users mailing list