Hello, clamav has the option --block-encrypted / ArchiveBlockEncrypted
this enables clamav to classify passwordprotected zip- and rarfiles as virus. this simple patch to libclamav/pdf.c classify passwordprotected pdf in the same way: --- snip 158,159c158,165 < cli_dbgmsg("cli_pdf: Encrypted PDF files not yet supported\n"); < return CL_CLEAN; --- > if(DETECT_ENCRYPTED) { > cli_dbgmsg("cli_pdf: Encrypted PDF found.\n"); > *ctx->virname = "Encrypted.Pdf"; > return CL_VIRUS; > } else { > cli_dbgmsg("cli_pdf: Encrypted PDF files not yet > supported\n"); > return CL_CLEAN; > } --- snap may the a fault inside ? -- Andreas Schulze Internetdienste | P532 DATEV eG 90329 Nürnberg | Telefon +49 911 319-0 | Telefax +49 911 319-3196 E-Mail info @datev.de | Internet www.datev.de Sitz: 90429 Nürnberg, Paumgartnerstr. 6-14 | Registergericht Nürnberg, GenReg Nr.70 Vorstand Prof. Dieter Kempf (Vorsitzender) Dipl.-Kfm. Wolfgang Stegmann (stellvertretender Vorsitzender) Dipl.-Kfm. Michael Leistenschneider Jörg Rabe v. Pappenheim Dipl.-Vw. Eckhard Schwarzer Vorsitzender des Aufsichtsrates: Reinhard Verholen
GnuPG-Signatur.asc
Description: digitale Signatur dieser Nachricht von Andreas Schulze
_______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml