ClamWin Free Antivirus :: View topic

Posted: Tue Oct 03, 2006 8:12 am

ClamWin don't detect W32/Jeefo

This is the infected file for testing. Be careful!

[snip]URL Removed, please use https://cgi.clamav.net/sendvirus.cgi to send infected files[/snip]

It would be great include it on the ClamWin database.

UPDATED - SOLVED !
The problem is ClamWin don't scan inside .RAR files. But if you extract the file, ClamWin detect the virus very well.

Posted: Tue Oct 03, 2006 9:11 am

VitusTotal Information found about this file:

Antivirus Version Actualizaci??n Resultado
-------------------------------------------------
AntiVir 7.2.0.22 02.10.2006 W32/Jeefo
Authentium 4.93.8 02.10.2006 no ha encontrado virus
Avast 4.7.892.0 02.10.2006 Win32:Jeefo
AVG 386 02.10.2006 Win32/Hidrag.A
BitDefender 7.2 03.10.2006 Win32.Jeefo.A
CAT-QuickHeal 8.00 03.10.2006 W32.Jeefo.A
ClamAV devel-20060426 03.10.2006 W32.Jeefo
DrWeb n - no ha encontrado virus
eTrust-InoculateIT 23.73.11 02.10.2006 no ha encontrado virus
eTrust-Vet 30.3.3113 03.10.2006 no ha encontrado virus
Ewido 4.0 02.10.2006 Worm.VB.dz
Fortinet 2.82.0.0 03.10.2006 W32/Jeefo.A
F-Prot 3.16f 02.10.2006 no ha encontrado virus
F-Prot4 4.2.1.29 02.10.2006 W32/Jeefo.A
Ikarus 0.2.65.0 03.10.2006 no ha encontrado virus
Kaspersky 4.0.2.24 03.10.2006 Virus.Win32.Hidrag.a
McAfee 4864 02.10.2006 W32/Jeefo
Microsoft 1.1603 03.10.2006 Win32/Jeefo.A
NOD32v2 1.1787 02.10.2006 Win32/Jeefo.A
Norman 5.90.23 02.10.2006 no ha encontrado virus
Panda 9.0.0.4 02.10.2006 W32/Jeefo.A
Sophos 4.10.0 03.10.2006 W32/Jeefo-A
Symantec 8.0 03.10.2006 no ha encontrado virus
TheHacker 6.0.1.089 02.10.2006 W32/Jeefo.gen
UNA 1.83 03.10.2006 Win32.Hidrag
VBA32 3.11.1 03.10.2006 Win32.HLLP.Jeefo
VirusBuster 4.3.7:9 02.10.2006 Win32.Hidrag

Posted: Tue Oct 03, 2006 9:41 am

Problem solved !

Yes, ClamWin detects very well the virus W32/Jeefo, but in .EXE or inside a .ZIP, but no inside .RAR

It would be great improve ClamWin for scanning inside .RAR
I'm using WinRar v3.41

The option "submit sample" in https://cgi.clamav.net/sendvirus.cgi https://cgi.clamav.net/sendvirus.cgi only works with .ZIP.
The solucion is compress the file .RAR to .ZIP (the .ZIP have one file .RAR).

Thank you for ClamWin, a great antivirus !

Posted: Tue Oct 03, 2006 5:05 pm

Peter,

RAR support will have major improvements in the next release.

budtse