Re: [Devil-linux-develop] anti-virus & rar?

[Heiko Z. <he...@zu...>]

Heiko Zuerker wrote:
> hzu...@ra... wrote:
> 
>> On 02/06/2004 03:45:42 PM Friedrich Lobenstock wrote:
>>
>>> Bruce Smith wrote on 06.02.2004 21:28 MET:
>>>
>>>> I've got postfix/clamav/spamassassin/sagator running on a test box and
>>>> I've been forwarding myself spam and viruses to test it out.
>>>>
>>>> I sent myself the test Eicar virus signature that comes with comes
>>>
>>>
>>> with
>>>
>>>> sagator, and it caught it.  I then sent the virus in a zip file,
>>>
>>>
>>> gziped,
>>>
>>>> bzip2'ed, and a zip file inside a zip file, and it caught them all.
>>>> Then I sent the virus inside the .rar file supplied by sagator, and it
>>>> did NOT catch it.  The program unrar is on my DL box and runs fine.
>>>>
>>>> # whereis unrar
>>>> unrar: /usr/bin/unrar
>>>>
>>>> What am I missing?  Or is something broken?
>>>
>>>
>>> Try copying the rar file to this system.
>>> What is the output of "file .....rar"? What if you run rar manually
>>> on this file?
>>
>>
>>
>> Is unrar in the sagator chroot ?
>> Does sagator expect it in a different path?
> 
> 
> I just saw in my log the following line:
> Feb  6 19:09:43 src@gate clamd[585]: RAR support disabled.

I enabled rar support in clamav.conf , but it still doesn't work.

I saw in the current CVS version of sagator are fixes for the 
decompressor module. But I think we should wait until the next release 
is available, since he did some changes to the config file, too.

Heiko