Mailing List Archive

Hello,

clamav has the option --block-encrypted / ArchiveBlockEncrypted

this enables clamav to classify passwordprotected zip- and rarfiles as virus.

this simple patch to libclamav/pdf.c classify passwordprotected pdf in the same way:

--- snip
158,159c158,165
< cli_dbgmsg("cli_pdf: Encrypted PDF files not yet supported\n");
< return CL_CLEAN;
---
> if(DETECT_ENCRYPTED) {
> cli_dbgmsg("cli_pdf: Encrypted PDF found.\n");
> *ctx->virname = "Encrypted.Pdf";
> return CL_VIRUS;
> } else {
> cli_dbgmsg("cli_pdf: Encrypted PDF files not yet supported\n");
> return CL_CLEAN;
> }
--- snap

may the a fault inside ?


--
Andreas Schulze
Internetdienste | P532

DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen