Hello, clamav has the option --block-encrypted / ArchiveBlockEncrypted
this enables clamav to classify passwordprotected zip- and rarfiles as virus.
this simple patch to libclamav/pdf.c classify passwordprotected pdf in the same
way:
--- snip
158,159c158,165
< cli_dbgmsg("cli_pdf: Encrypted PDF files not yet supported\n");
< return CL_CLEAN;
---
> if(DETECT_ENCRYPTED) {
> cli_dbgmsg("cli_pdf: Encrypted PDF found.\n");
> *ctx->virname = "Encrypted.Pdf";
> return CL_VIRUS;
> } else {
> cli_dbgmsg("cli_pdf: Encrypted PDF files not yet
> supported\n");
> return CL_CLEAN;
> }
--- snap
may the a fault inside ?
--
Andreas Schulze
Internetdienste | P532
DATEV eG
90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196
E-Mail info @datev.de | Internet www.datev.de
Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg
Nr.70
Vorstand
Prof. Dieter Kempf (Vorsitzender)
Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender)
Dipl.-Kfm. Michael Leistenschneider
Jörg Rabe v. Pappenheim
Dipl.-Vw. Eckhard Schwarzer
Vorsitzender des Aufsichtsrates: Reinhard Verholen
GnuPG-Signatur.asc
Description: digitale Signatur dieser Nachricht von Andreas Schulze
_______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
