ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
email and .RAR archives
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
Hi everybody!

I just discovered that CLAMSCAN.EXE can't scan a .RAR archive if this is an attachment embedded into an email file.

I tried different switches (unrar, unzip) but no matter how hard I try, the messages is always ignored.

Several archives in .GZ, .RAR, .ZIP, .BZ2 get correctly detected. But a RAR inside an .EML file doesn't.

Is this a bug? I use clamscan inside a script on my email server, and as of now I have no way of checking those archives.

Best regards
Vanni
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
RAR support is very limited in clamav, it only supports RAR2 archives. You should be able to use unrar.exe (from unix port) with --unrar=<path to unrar.exe> command line option. The next update should have improved RAR files support.
View user's profileSend private message
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
Thank you for your quick reply!

Yes, I noticed that the support was lacking, and I copied in the system path the latest unrar.exe from rarlabs.

The point is, clamscan manages to extract with --unrar when it finds a .RAR archive file. The test file gets extracted, scanned and correctly identified.
On the other side, if I put the complete email message somewhere, and try to scan that file with clamscan, only executables alone and other archives (zip, gz, bz2) or plain executables get correctly handled.

Seems like clamscan can't identify the attachment as a .RAR archive and goes on checking without triggering the archive handler. But ONLY when the archive is .RAR and inside an email message.

Hope this helps you
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
do you have "Treat files as Mailboxes" option selected in clamwin advanced options? (turning this option off adds --no-mail parameter to clamscan.exe command line)
View user's profileSend private message
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
no, I'm using a script to automatically perform the scan of each email arriving on my server.

As I said, other archives inside email files get correctly identified, trigger the extraction part, then get scanned and identified. The mail server sees the trigger from the errorlevel the script leaves and forwards the virus to me rather than delivering it. The only kind of archive that's not treated is .RAR

Ah, also .7z is unknown, luckily I haven't seen it used that much.

Thanks for the good work
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
hmm, odd. I'll test here when get a abit of free time. 7z is not supported by clamav yet
View user's profileSend private message
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
hi

I just remembered the --debug feature and I'm giving it a try to see what's up with that email with a rar inside. As of now, the email is correctly identified, the unrarlib gets called but then something goes wrong.

Code:

LibClamAV debug: fileblobSetFilename: mkstemp(_______\temp/clamav-8176506c32df6051/textpartXXXXXX)
LibClamAV debug: Saving attachment as _______\temp/clamav-8176506c32df6051/textpartwqdLGc
LibClamAV debug: fileblobDestroy: textpart
LibClamAV debug: cli_mbox returning 0
LibClamAV debug: Recognized RAR file
LibClamAV debug: in scanrar()
LibClamAV debug: ..\..\libclamav\unrarlib.c:2658:InitCRC Initialize CRC table
LibClamAV debug: ExtrFile(): dup(5) = 6
LibClamAV debug: Couldn't read next filename from archive (I/O error): 0
LibClamAV debug: RAR: Number of archived files: 1
LibClamAV debug: RAR: eicar.com, crc32: 0x6851cf3c, encrypted: 0, compressed: 68, normal: 68, method: 48, ratio: 1 (max: 250)
LibClamAV debug: ExtrFile(): dup(5) = 7
LibClamAV debug: unrarlib: Allocated 1048576 bytes.
LibClamAV debug: unrarlib: Allocating 68 bytes
LibClamAV debug: unknown compression method: 29  (min=13 max=20)
LibClamAV debug: RAR: Can't decompress file eicar.com
LibClamAV debug: RAR: Exit code: 100
LibClamAV debug: Virus offset: 66, expected: 0 (Eicar-Test-Signature)
LibClamAV debug: Calculated MD5 checksum: 9c4bf9b5558b1827f2f387192ec9f4f2
LibClamAV debug: Small data (3 bytes)


Now I'll do some more tests with different unrar executables to see what the results are.

edit 31-08-2006 09:45

The attachment decoding routine does well, decodes the attachment, then passes on the control to the unpacking routine. This one calls unrarlib and when this fails due to unknown compression method, instead of correctly interpreting the --UNRAR cmd line parameter, simply quits right after printing the last line.

Here is the output from the same scan done on the archive without email wrapping.

Code:
LibClamAV debug: Recognized RAR file
LibClamAV debug: in scanrar()
LibClamAV debug: ..\..\libclamav\unrarlib.c:2658:InitCRC Initialize CRC table
LibClamAV debug: ExtrFile(): dup(4) = 5
LibClamAV debug: Couldn't read next filename from archive (I/O error): 0
LibClamAV debug: RAR: Number of archived files: 1
LibClamAV debug: RAR: eicar.com, crc32: 0x6851cf3c, encrypted: 0, compressed: 68, normal: 68, method: 48, ratio: 1 (max: 250)
LibClamAV debug: ExtrFile(): dup(4) = 6
LibClamAV debug: unrarlib: Allocated 1048576 bytes.
LibClamAV debug: unrarlib: Allocating 68 bytes
LibClamAV debug: unknown compression method: 29  (min=13 max=20)
LibClamAV debug: RAR: Can't decompress file eicar.com
LibClamAV debug: RAR: Exit code: 100
LibClamAV debug: Virus offset: 66, expected: 0 (Eicar-Test-Signature)
LibClamAV debug: Calculated MD5 checksum: 9c4bf9b5558b1827f2f387192ec9f4f2
V:\Desktop\b/eicar.rar: RAR module failure

UNRAR 3.00 beta 7 freeware      Copyright (c) 1993-2002 Eugene Roshal


Extracting from V:\Desktop\b/eicar.rar

Extracting  eicar.com                                                 OK
All OK
LibClamAV debug: Eicar-Test-Signature found in descriptor 4.
_______\temp/clamav-35f378a0c4e097aa/eicar.com: Eicar-Test-Signature FOUND
V:\Desktop\b/eicar.rar: Infected.Archive FOUND


Seems to me that only in case of email wrapped archive the unrarlib failure isn't correctly recognized, leading to the archive not being passed through the external unrar routine, even if specified.
This happens both with unrar from unxutils and with unrar from the winrar site.

meanwhile I think I'll setup a filter not letting through RAR archives. Wink one never knows

edit 31-08-2006 10:48

While browsing I found the clamav native port http://www.bandsman.co.uk/clamav.htm here.

Seems to be compiled against clamav CVS, and seems to have fixed this issue. While I still wait to see it fixed with clamwin, I'll try to use that as a temporary fix.

Bye
Vanni
View user's profileSend private message
email and .RAR archives
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic