> > I've got postfix/clamav/spamassassin/sagator running on a test box and
> > I've been forwarding myself spam and viruses to test it out.
> >
> > I sent myself the test Eicar virus signature that comes with comes with
> > sagator, and it caught it. I then sent the virus in a zip file, gziped,
> > bzip2'ed, and a zip file inside a zip file, and it caught them all.
> > Then I sent the virus inside the .rar file supplied by sagator, and it
> > did NOT catch it. The program unrar is on my DL box and runs fine.
> >
> > # whereis unrar
> > unrar: /usr/bin/unrar
> >
> > What am I missing? Or is something broken?
>
> Try copying the rar file to this system.
It is the exact file I copied from:
.../lfssystem/data/build/tmp/sagator/test/pack/test.rar
These are files that sagator supplies for testing.
(along with other files containing virus sigs, which are all caught)
> What is the output of "file .....rar"? What if you run rar manually
> on this file?
# from my DL test box:
root@test:/tmp # file test.rar
test.rar: RAR archive data, v14, os: Unix
root@test:/tmp # unrar l test.rar
UNRAR 3.20 freeware Copyright (c) 1993-2003 Eugene Roshal
Archive test.rar
Name Size Packed Ratio Date Time Attr CRC Meth Ver
-------------------------------------------------------------------------------
d 0 0 0% 02-07-03 13:03 drwxrwxr-x 00000000 m0 2.0
emptydir 0 0 0% 02-07-03 13:03 drwxrwxr-x 00000000 m0 2.0
useddir 0 0 0% 02-07-03 15:14 drwxrwxr-x 00000000 m0 2.0
file 9 21 100% 02-07-03 13:03 -rw-rw-r-- FFE2DDD2 m3b 2.9
empty 0 8 0% 02-07-03 13:03 -rw-rw-r-- 00000000 m3b 2.9
Eicar 178 172 96% 16-06-03 07:50 -rw-rw-r-- 38612FED m3b 2.9
-------------------------------------------------------------------------------
6 187 201 100%
root@test:/tmp #
|
