ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Problems with zip files
educacio


Joined: 21 Feb 2006
Posts: 7
Reply with quote
Hello,

I have an eicar.com signature virus compressed as a zip file in a Windows XP prof . When I analyze this virus from the administrator account clamwin detects it, but when I do the same from an user account clamwin doesn’t detects any virus.

I try to do the same with a clamscan command line with the flag --unzip but I have this message:

Unpacker stopped with external signal –1

Perhaps I don’t know the correct use of this line ?--unzip[=FULLPATH]? , what is exactly the meaning of ?FULLPATH?

Thanks a lot,

PD: Sorry for my english
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
check that a user has access to the %TEMP% dir


Also if you scan eicar.com directly (not in zip archive) will clamwin detect it when running under user account?
View user's profileSend private message
educacio


Joined: 21 Feb 2006
Posts: 7
Reply with quote
Hi Alch,

Yes, I have access to the %TEMP% dir (in fact there are some files created by ClamWin inside it) and I can scan directly eicar.com form the user account.

Thanks,
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
can you paste the scan report after scanning eicar.zip in the user account?
also check the file system security permissions on eicar.zip to see if a user can access it.
View user's profileSend private message
notorp


Joined: 27 Apr 2006
Posts: 3
Reply with quote
I'm seeing the same problem with both the eicar test zip files. In this case I am logged in as a user with administrator permissions. OS is Win2K clamwin 0.88 db update 26/04/06.

It appears not to work with either direct scanning of the zip files or scanning the directory. Perhaps it is linked to the .com failed error reported on this thread:

http://forums.clamwin.com/viewtopic.php?t=279&highlight=eicar+zip

For reference I can open the zip and see the file.


Quote:

--------------------------------------

Scan started: Thu Apr 27 08:33:59 2006





-- summary --

Known viruses: 53081

Engine version: 0.88

Scanned directories: 0

Scanned files: 2

Infected files: 0



Data scanned: 0.00 MB

Time: 2.541 sec (0 m 2 s)

-------------------

Completed

-------------------

[url][/url]
View user's profileSend private message
Appears to be resolved with new 0.88.1 clamscan
notorp


Joined: 27 Apr 2006
Posts: 3
Reply with quote
I've just updgraded to 0.88.1 and after a breif inability to initialise DB it now works and best of all it now successfully determines the virus in the zip files.

Quote:

--------------------------------------
Scan started: Thu Apr 27 09:26:59 2006
\eicar_com.zip: moved to 'C:\Documents and Settings\All Users\.clamwin\quarantine\eicar_com.zip'
\Desktop\eicar_com.zip: Eicar-Test-Signature FOUND
-- summary --
Known viruses: 53081
Engine version: 0.88.1
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Time: 2.281 sec (0 m 2 s)
-------------------
Completed
-------------------


and file 2:
Quote:

--------------------------------------
Scan started: Thu Apr 27 09:27:19 2006
\Desktop\eicarcom2.zip: moved to 'C:\Documents and Settings\All Users\.clamwin\quarantine\eicarcom2.zip'
\Desktop\eicarcom2.zip: Eicar-Test-Signature FOUND
-- summary --
Known viruses: 53081
Engine version: 0.88.1
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Time: 1.984 sec (0 m 1 s)
-------------------
Completed
-------------------
View user's profileSend private message
educacio


Joined: 21 Feb 2006
Posts: 7
Reply with quote
Hi,

I send you the scan report after scanning eicar.zip in the user account


--------------------------------------
Scan started: Wed May 03 12:25:03 2006

-- summary --
Known viruses: 53234
Engine version: 0.88.2
Scanned directories: 0
Scanned files: 1
Infected files: 0

Data scanned: 0.00 MB
Time: 1.598 sec (0 m 1 s)
-------------------------------------
Completed
--------------------------------------

If I use the clamscan command line utility I have this error in the log file:

ERROR:
Unpacker stopped with external signal –1

Thanks,
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
educacio wrote:
Hi,

I send you the scan report after scanning eicar.zip in the user account




Please check eicar.zip security permissions and try on a different computer
View user's profileSend private message
educacio


Joined: 21 Feb 2006
Posts: 7
Reply with quote
Hello,

I’ve checked the eicar.zip in four computers, three integrated in a windows domain and the last one a member of a workgroup, in all the computers Clamwin detects the eicar.com and eicar.com.txt virus but doesn’t detect the eicar.zip virus.

The logged user has full access to the eicard.zip files.

I suppose that I’m doing something wrong! Sad

Thanks for all.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
please put the zip file inside a password-protected archive and send it to [clamwin at clamwin.com]. Put the password in the email too.

Thanks
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
I have released 0.88.2.3 which fixes that problem, thanks for finding it.
View user's profileSend private message
Problems with zip files
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic