Re: [Devil-linux-develop] anti-virus & rar?

[Bruce S. <bw...@ar...>]

> > I've got postfix/clamav/spamassassin/sagator running on a test box and
> > I've been forwarding myself spam and viruses to test it out.
> > 
> > I sent myself the test Eicar virus signature that comes with comes with
> > sagator, and it caught it.  I then sent the virus in a zip file, gziped,
> > bzip2'ed, and a zip file inside a zip file, and it caught them all.
> > Then I sent the virus inside the .rar file supplied by sagator, and it
> > did NOT catch it.  The program unrar is on my DL box and runs fine.
> > 
> > # whereis unrar
> > unrar: /usr/bin/unrar
> > 
> > What am I missing?  Or is something broken?
> 
> Try copying the rar file to this system.

It is the exact file I copied from:
.../lfssystem/data/build/tmp/sagator/test/pack/test.rar

These are files that sagator supplies for testing. 
(along with other files containing virus sigs, which are all caught)

> What is the output of "file .....rar"? What if you run rar manually
> on this file?

# from my DL test box:

root@test:/tmp # file test.rar
test.rar: RAR archive data, v14, os: Unix

root@test:/tmp # unrar l test.rar
 
UNRAR 3.20 freeware      Copyright (c) 1993-2003 Eugene Roshal
 
Archive test.rar
 
 Name             Size   Packed Ratio  Date   Time     Attr      CRC   Meth Ver
-------------------------------------------------------------------------------
 d                   0        0   0% 02-07-03 13:03 drwxrwxr-x 00000000 m0  2.0
 emptydir            0        0   0% 02-07-03 13:03 drwxrwxr-x 00000000 m0  2.0
 useddir             0        0   0% 02-07-03 15:14 drwxrwxr-x 00000000 m0  2.0
 file                9       21 100% 02-07-03 13:03 -rw-rw-r-- FFE2DDD2 m3b 2.9
 empty               0        8   0% 02-07-03 13:03 -rw-rw-r-- 00000000 m3b 2.9
 Eicar             178      172  96% 16-06-03 07:50 -rw-rw-r-- 38612FED m3b 2.9
-------------------------------------------------------------------------------
    6              187      201 100%
 
root@test:/tmp #