On Mon, Dec 23, 2013 at 9:08 AM, gin(e) <[email protected]> wrote: > Hi, i am new here. I refer my email to this thread: > http://lurker.clamav.net/message/20130929.101600.e8530842.en.html > > I got a similar warning message of Jamen McGranahan on every scan that > cron run. And i like to understand what's happen. > > $ clamscan juzni_kriz.swf &>swf_log > ----------- SCAN SUMMARY ----------- > Known viruses: 3034997 > Engine version: 0.98-exp > Scanned directories: 0 > Scanned files: 1 > Infected files: 0 > Data scanned: 0.68 MB > Data read: 0.68 MB (ratio 1.01:1) > Time: 24.583 sec (0 m 24 s) > LibClamAV Warning: SWF: Invalid tag length. > juzni_kriz.swf: OK > > $ file juzni_kriz.swf > juzni_kriz.swf: Macromedia Flash data, version 6 > > If it's needed i can upload (tell me where) that file. > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > http://www.clamav.net/support/ml >
ClamAV is scanning the Flash file and is finding a tag that has a length that is too long for the file. This would most commonly occur if file is truncated. Dave R. -- --- Dave Raynor Sourcefire Vulnerability Research Team [email protected] _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml
