Hello,

I have an eicar.com signature virus compressed as a zip file in a Windows XP prof . When I analyze this virus from the administrator account clamwin detects it, but when I do the same from an user account clamwin doesn’t detects any virus.

I try to do the same with a clamscan command line with the flag --unzip but I have this message:

Unpacker stopped with external signal –1

Perhaps I don’t know the correct use of this line �--unzip[=FULLPATH]� , what is exactly the meaning of �FULLPATH�

Thanks a lot,

PD: Sorry for my english

check that a user has access to the %TEMP% dir


Also if you scan eicar.com directly (not in zip archive) will clamwin detect it when running under user account?

Hi Alch,

Yes, I have access to the %TEMP% dir (in fact there are some files created by ClamWin inside it) and I can scan directly eicar.com form the user account.

Thanks,

can you paste the scan report after scanning eicar.zip in the user account?
also check the file system security permissions on eicar.zip to see if a user can access it.

I'm seeing the same problem with both the eicar test zip files. In this case I am logged in as a user with administrator permissions. OS is Win2K clamwin 0.88 db update 26/04/06.

It appears not to work with either direct scanning of the zip files or scanning the directory. Perhaps it is linked to the .com failed error reported on this thread:

https://forums.clamwin.com/viewtopic.php?t=279&highlight=eicar+zip

For reference I can open the zip and see the file.


[url][/url]

I've just updgraded to 0.88.1 and after a breif inability to initialise DB it now works and best of all it now successfully determines the virus in the zip files.



and file 2:

Hi,

I send you the scan report after scanning eicar.zip in the user account


--------------------------------------
Scan started: Wed May 03 12:25:03 2006

-- summary --
Known viruses: 53234
Engine version: 0.88.2
Scanned directories: 0
Scanned files: 1
Infected files: 0

Data scanned: 0.00 MB
Time: 1.598 sec (0 m 1 s)
-------------------------------------
Completed
--------------------------------------

If I use the clamscan command line utility I have this error in the log file:

ERROR:
Unpacker stopped with external signal –1

Thanks,

Please check eicar.zip security permissions and try on a different computer

Hello,

I’ve checked the eicar.zip in four computers, three integrated in a windows domain and the last one a member of a workgroup, in all the computers Clamwin detects the eicar.com and eicar.com.txt virus but doesn’t detect the eicar.zip virus.

The logged user has full access to the eicard.zip files.

I suppose that I’m doing something wrong!

Thanks for all.

please put the zip file inside a password-protected archive and send it to [clamwin at clamwin.com]. Put the password in the email too.

Thanks

I have released 0.88.2.3 which fixes that problem, thanks for finding it.