[clamav-users] Detection glitch on series of Excel files

[G.W. Haywood]

Hi Kris,

On Fri, 25 Mar 2022, Kris Deugau wrote:

> I've been seeing a series of Excel files recently that seem to be triggering 
> a bug of some kind.
> ...

What version of ClamAV?

> ... clamscan -d test.hdb on one of these files produces a result like this:
>
> Invoice 251064533 QT8094914.xls: 
> e3af082cc2ec644830a69ddafe5abe31_1.UNOFFICIAL FOUND
> Invoice 251064533 QT8094914.xls: OK
>
> and a summary of "0 infected files".
>
> clamscan --allmatch produces, not the pair of distinct matches I expected, 
> but:
>
> Invoice 251064533 QT8094914.xls: 
> e3af082cc2ec644830a69ddafe5abe31_1.UNOFFICIAL FOUND
> Invoice 251064533 QT8094914.xls: 
> e3af082cc2ec644830a69ddafe5abe31_1.UNOFFICIAL FOUND

Looks horribly wrong Kris, sounds like one for Github 'issues'.

-- 

73,
Ged.