I ran some tests after my last posting to answer just this question, but results were mixed so I was waiting for an authoritative answer. Since we haven’t heard yet, I’ll post my results.
First I made my own .dmg with an eicar test file on-board. Running clamscan —debut on the file did not detect any infection nor did it identify the file as a DMG: > LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16) > LibClamAV debug: Recognized binary data > LibClamAV debug: cache_check: ff8fdbcdb89e9474452237677b5f09e9 is negative > LibClamAV debug: in cli_check_mydoom_log() > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: ff8fdbcdb89e9474452237677b5f09e9 (level 0) > /Volumes/Macintosh HD/Users/avarnell/Documents/EicarTest.dmg: OK > LibClamAV debug: Cleaning up phishcheck > LibClamAV debug: Freeing phishcheck struct > LibClamAV debug: Phishcheck cleaned up > > ----------- SCAN SUMMARY ----------- > Known viruses: 3778735 > Engine version: 0.98.6 > Scanned directories: 0 > Scanned files: 1 > Infected files: 0 > Data scanned: 7.62 MB > Data read: 7.55 MB (ratio 1.01:1) > Time: 7.553 sec (0 m 7 s) When I mounted the EicarTest.dmg ClamXav Sentry (real-time process using clamd) caught it immediately. ======= Next I scanned download.dmg which was known to contained the FkCodec adware. It detected the hash value as expected and also matched three ZIP segments and the DMG container: > LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16) > LibClamAV debug: Recognized binary data > LibClamAV debug: cache_check: b4ece10d1e706b87b065523a654d48a7 is negative > LibClamAV debug: in cli_check_mydoom_log() > LibClamAV debug: Matched signature for file type ZIP-SFX at 376602 > LibClamAV debug: Matched signature for file type ZIP-SFX at 407295 > LibClamAV debug: Matched signature for file type ZIP-SFX at 563034 > LibClamAV debug: Matched signature for file type DMG container file at 626691 > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: Adware.OSX found > LibClamAV debug: FP SIGNATURE: > b4ece10d1e706b87b065523a654d48a7:627203:Adware.OSX > LibClamAV debug: cli_magic_scandesc: returning 1 at line 2470 > /Users/avarnell/Desktop/•Download/Malware/FkCodec-A/download.dmg: Adware.OSX > FOUND > LibClamAV debug: Cleaning up phishcheck > LibClamAV debug: Freeing phishcheck struct > LibClamAV debug: Phishcheck cleaned up > > ----------- SCAN SUMMARY ----------- > Known viruses: 3778290 > Engine version: 0.98.6 > Scanned directories: 0 > Scanned files: 1 > Infected files: 1 > Data scanned: 0.60 MB > Data read: 0.60 MB (ratio 1.01:1) > Time: 7.419 sec (0 m 7 s) When I mounted the download.dmg Sentry caught Codec-M Installer.app/Contents/MacOS/Installer: Osx.Trojan.Fakecodecs-1 immediately. ========= Last I scanned CleanApp 4.0.8 Mac 中文版.dmg which was known to contain the Machook or WireLurker malware. I also knew that an unofficail has signature was available only to ClamXav users. It detects the hash value as expected but also was able to decompose 13 segments each with several sections. Apologies for the length: > LibClamAV debug: in cli_magic_scandesc (reclevel: 0/16) > LibClamAV debug: Recognized binary data > LibClamAV debug: cache_check: 819dfe85859c382bfc80a5537b5241c1 is negative > LibClamAV debug: in cli_check_mydoom_log() > LibClamAV debug: Matched signature for file type ZIP-SFX at 11333950 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12084165 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12131902 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12196825 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12215589 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12371083 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12383952 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12912356 > LibClamAV debug: Matched signature for file type ZIP-SFX at 12952749 > LibClamAV debug: Matched signature for file type ZIP-SFX at 13016886 > LibClamAV debug: Matched signature for file type ZIP-SFX at 13016948 > LibClamAV debug: Matched signature for file type ZIP-SFX at 13040734 > LibClamAV debug: Matched signature for file type DMG container file at > 25615107 > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: ZIP/ZIP-SFX signature found at 11333950 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libiconv.2.dylib:1048064:750135:21d33511:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:750135:dylib/libiconv.2.dylib:750135:1048064:0:0:567489809:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-33964e3ca2809fa9233a7d9c36f0e5b4.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 94f9882f5db1883e7295b44c440eb44c is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 14 > LibClamAV debug: MACHO: Size of load commands: 1712 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 8 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0xddc > LibClamAV debug: MACHO: Virtual size: 86831 > LibClamAV debug: MACHO: Raw size: 86832 > LibClamAV debug: MACHO: File offset: 3548 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x1610c > LibClamAV debug: MACHO: Virtual size: 90 > LibClamAV debug: MACHO: Raw size: 90 > LibClamAV debug: MACHO: File offset: 90380 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x16168 > LibClamAV debug: MACHO: Virtual size: 166 > LibClamAV debug: MACHO: Raw size: 168 > LibClamAV debug: MACHO: File offset: 90472 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x16210 > LibClamAV debug: MACHO: Virtual size: 908080 > LibClamAV debug: MACHO: Raw size: 908080 > LibClamAV debug: MACHO: File offset: 90640 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0xf3d40 > LibClamAV debug: MACHO: Virtual size: 38 > LibClamAV debug: MACHO: Raw size: 38 > LibClamAV debug: MACHO: File offset: 998720 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __ustring > LibClamAV debug: MACHO: Virtual address: 0xf3d70 > LibClamAV debug: MACHO: Virtual size: 78 > LibClamAV debug: MACHO: Raw size: 80 > LibClamAV debug: MACHO: File offset: 998768 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0xf3dbe > LibClamAV debug: MACHO: Virtual size: 496 > LibClamAV debug: MACHO: Raw size: 496 > LibClamAV debug: MACHO: File offset: 998846 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0xf3fb0 > LibClamAV debug: MACHO: Virtual size: 72 > LibClamAV debug: MACHO: Raw size: 72 > LibClamAV debug: MACHO: File offset: 999344 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 6 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0xf4000 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 999424 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0xf4010 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 999440 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0xf4020 > LibClamAV debug: MACHO: Virtual size: 120 > LibClamAV debug: MACHO: Raw size: 120 > LibClamAV debug: MACHO: File offset: 999456 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0xf40a0 > LibClamAV debug: MACHO: Virtual size: 5840 > LibClamAV debug: MACHO: Raw size: 5840 > LibClamAV debug: MACHO: File offset: 999584 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0xf5770 > LibClamAV debug: MACHO: Virtual size: 36 > LibClamAV debug: MACHO: Raw size: 48 > LibClamAV debug: MACHO: File offset: 1005424 > LibClamAV debug: MACHO: --- Section 13 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0xf5798 > LibClamAV debug: MACHO: Virtual size: 49 > LibClamAV debug: MACHO: Raw size: 56 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 94f9882f5db1883e7295b44c440eb44c (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12084165 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libimobiledevice.4.dylib:139988:47649:67e1fbed:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:47649:dylib/libimobiledevice.4.dylib:47649:139988:0:0:1742863341:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-b2def51f8629ba2ecaded5e4572b5eb7.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 5b0412e19ec0af5ce375b8ab5a0bc5db is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 19 > LibClamAV debug: MACHO: Size of load commands: 2224 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 8 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x1030 > LibClamAV debug: MACHO: Virtual size: 61004 > LibClamAV debug: MACHO: Raw size: 61008 > LibClamAV debug: MACHO: File offset: 4144 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0xfe7c > LibClamAV debug: MACHO: Virtual size: 936 > LibClamAV debug: MACHO: Raw size: 936 > LibClamAV debug: MACHO: File offset: 65148 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x10224 > LibClamAV debug: MACHO: Virtual size: 1576 > LibClamAV debug: MACHO: Raw size: 1576 > LibClamAV debug: MACHO: File offset: 66084 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x10850 > LibClamAV debug: MACHO: Virtual size: 64 > LibClamAV debug: MACHO: Raw size: 64 > LibClamAV debug: MACHO: File offset: 67664 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x10890 > LibClamAV debug: MACHO: Virtual size: 4300 > LibClamAV debug: MACHO: Raw size: 4300 > LibClamAV debug: MACHO: File offset: 67728 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __ustring > LibClamAV debug: MACHO: Virtual address: 0x1195c > LibClamAV debug: MACHO: Virtual size: 92 > LibClamAV debug: MACHO: Raw size: 92 > LibClamAV debug: MACHO: File offset: 72028 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x119b8 > LibClamAV debug: MACHO: Virtual size: 948 > LibClamAV debug: MACHO: Raw size: 948 > LibClamAV debug: MACHO: File offset: 72120 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x11d70 > LibClamAV debug: MACHO: Virtual size: 648 > LibClamAV debug: MACHO: Raw size: 648 > LibClamAV debug: MACHO: File offset: 73072 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 8 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x12000 > LibClamAV debug: MACHO: Virtual size: 24 > LibClamAV debug: MACHO: Raw size: 24 > LibClamAV debug: MACHO: File offset: 73728 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x12018 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 73752 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x12028 > LibClamAV debug: MACHO: Virtual size: 1248 > LibClamAV debug: MACHO: Raw size: 1248 > LibClamAV debug: MACHO: File offset: 73768 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __mod_init_func > LibClamAV debug: MACHO: Virtual address: 0x12508 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 75016 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __mod_term_func > LibClamAV debug: MACHO: Virtual address: 0x12510 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 75024 > LibClamAV debug: MACHO: --- Section 13 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0x12518 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: File offset: 75032 > LibClamAV debug: MACHO: --- Section 14 --- > LibClamAV debug: MACHO: Name: __common > LibClamAV debug: MACHO: Virtual address: 0x12540 > LibClamAV debug: MACHO: Virtual size: 4 > LibClamAV debug: MACHO: Raw size: 4 > LibClamAV debug: MACHO: --- Section 15 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0x12548 > LibClamAV debug: MACHO: Virtual size: 32 > LibClamAV debug: MACHO: Raw size: 32 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 5b0412e19ec0af5ce375b8ab5a0bc5db (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12131902 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/liblzma.5.dylib:128180:64844:9bf560e2:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:64844:dylib/liblzma.5.dylib:64844:128180:0:0:2616549602:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-4f4ac1d0fe897686eb45e80684510a5b.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 9ebf9c0d25e418c8d0bed2a335aac8bf is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 14 > LibClamAV debug: MACHO: Size of load commands: 1472 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x1a14 > LibClamAV debug: MACHO: Virtual size: 75782 > LibClamAV debug: MACHO: Raw size: 75784 > LibClamAV debug: MACHO: File offset: 6676 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x1421a > LibClamAV debug: MACHO: Virtual size: 54 > LibClamAV debug: MACHO: Raw size: 54 > LibClamAV debug: MACHO: File offset: 82458 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x14250 > LibClamAV debug: MACHO: Virtual size: 106 > LibClamAV debug: MACHO: Raw size: 108 > LibClamAV debug: MACHO: File offset: 82512 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x142ba > LibClamAV debug: MACHO: Virtual size: 6 > LibClamAV debug: MACHO: Raw size: 6 > LibClamAV debug: MACHO: File offset: 82618 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x142c0 > LibClamAV debug: MACHO: Virtual size: 25536 > LibClamAV debug: MACHO: Raw size: 25536 > LibClamAV debug: MACHO: File offset: 82624 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x1a680 > LibClamAV debug: MACHO: Virtual size: 864 > LibClamAV debug: MACHO: Raw size: 864 > LibClamAV debug: MACHO: File offset: 108160 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x1a9e0 > LibClamAV debug: MACHO: Virtual size: 1560 > LibClamAV debug: MACHO: Raw size: 1560 > LibClamAV debug: MACHO: File offset: 109024 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 4 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x1b000 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 110592 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x1b010 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 110608 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x1b018 > LibClamAV debug: MACHO: Virtual size: 72 > LibClamAV debug: MACHO: Raw size: 72 > LibClamAV debug: MACHO: File offset: 110616 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x1b060 > LibClamAV debug: MACHO: Virtual size: 800 > LibClamAV debug: MACHO: Raw size: 800 > LibClamAV debug: MACHO: File offset: 110688 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 9ebf9c0d25e418c8d0bed2a335aac8bf (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12196825 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libplist.2.dylib:51836:18684:6c5e3dd9:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:18684:dylib/libplist.2.dylib:18684:51836:0:0:1818115545:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-0a99e39012a97d43e2ec1fa317ad7366.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 109a09389abef9a9388de08f7021b4cf is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 15 > LibClamAV debug: MACHO: Size of load commands: 1448 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x1190 > LibClamAV debug: MACHO: Virtual size: 21720 > LibClamAV debug: MACHO: Raw size: 21728 > LibClamAV debug: MACHO: File offset: 4496 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x6668 > LibClamAV debug: MACHO: Virtual size: 222 > LibClamAV debug: MACHO: Raw size: 222 > LibClamAV debug: MACHO: File offset: 26216 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x6748 > LibClamAV debug: MACHO: Virtual size: 386 > LibClamAV debug: MACHO: Raw size: 388 > LibClamAV debug: MACHO: File offset: 26440 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x68d0 > LibClamAV debug: MACHO: Virtual size: 730 > LibClamAV debug: MACHO: Raw size: 736 > LibClamAV debug: MACHO: File offset: 26832 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x6bb0 > LibClamAV debug: MACHO: Virtual size: 456 > LibClamAV debug: MACHO: Raw size: 464 > LibClamAV debug: MACHO: File offset: 27568 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x6d78 > LibClamAV debug: MACHO: Virtual size: 348 > LibClamAV debug: MACHO: Raw size: 348 > LibClamAV debug: MACHO: File offset: 28024 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x6ed8 > LibClamAV debug: MACHO: Virtual size: 288 > LibClamAV debug: MACHO: Raw size: 288 > LibClamAV debug: MACHO: File offset: 28376 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 3 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x7000 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 28672 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x7010 > LibClamAV debug: MACHO: Virtual size: 24 > LibClamAV debug: MACHO: Raw size: 24 > LibClamAV debug: MACHO: File offset: 28688 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x7028 > LibClamAV debug: MACHO: Virtual size: 296 > LibClamAV debug: MACHO: Raw size: 296 > LibClamAV debug: MACHO: File offset: 28712 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 109a09389abef9a9388de08f7021b4cf (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12215589 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libssl.1.0.0.dylib:369952:155412:35862145:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:155412:dylib/libssl.1.0.0.dylib:155412:369952:0:0:897982789:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-10177d6fe82e82e9e41ec0a90784f30a.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: ab09435c0358b102a5d08f34aae3c244 is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 16 > LibClamAV debug: MACHO: Size of load commands: 1760 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x1450 > LibClamAV debug: MACHO: Virtual size: 232337 > LibClamAV debug: MACHO: Raw size: 232352 > LibClamAV debug: MACHO: File offset: 5200 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x39fe2 > LibClamAV debug: MACHO: Virtual size: 2160 > LibClamAV debug: MACHO: Raw size: 2160 > LibClamAV debug: MACHO: File offset: 237538 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x3a854 > LibClamAV debug: MACHO: Virtual size: 3616 > LibClamAV debug: MACHO: Raw size: 3616 > LibClamAV debug: MACHO: File offset: 239700 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x3b674 > LibClamAV debug: MACHO: Virtual size: 23398 > LibClamAV debug: MACHO: Raw size: 23398 > LibClamAV debug: MACHO: File offset: 243316 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x411e0 > LibClamAV debug: MACHO: Virtual size: 808 > LibClamAV debug: MACHO: Raw size: 816 > LibClamAV debug: MACHO: File offset: 266720 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x41508 > LibClamAV debug: MACHO: Virtual size: 1444 > LibClamAV debug: MACHO: Raw size: 1444 > LibClamAV debug: MACHO: File offset: 267528 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x41ab0 > LibClamAV debug: MACHO: Virtual size: 1360 > LibClamAV debug: MACHO: Raw size: 1360 > LibClamAV debug: MACHO: File offset: 268976 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 6 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x42000 > LibClamAV debug: MACHO: Virtual size: 80 > LibClamAV debug: MACHO: Raw size: 80 > LibClamAV debug: MACHO: File offset: 270336 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x42050 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 270416 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x42060 > LibClamAV debug: MACHO: Virtual size: 2880 > LibClamAV debug: MACHO: Raw size: 2880 > LibClamAV debug: MACHO: File offset: 270432 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x42ba0 > LibClamAV debug: MACHO: Virtual size: 11944 > LibClamAV debug: MACHO: Raw size: 11952 > LibClamAV debug: MACHO: File offset: 273312 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0x45a50 > LibClamAV debug: MACHO: Virtual size: 21552 > LibClamAV debug: MACHO: Raw size: 21552 > LibClamAV debug: MACHO: File offset: 285264 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0x4ae80 > LibClamAV debug: MACHO: Virtual size: 192 > LibClamAV debug: MACHO: Raw size: 192 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: ab09435c0358b102a5d08f34aae3c244 (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12371083 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libusbmuxd.2.dylib:34784:12787:f15a2b41:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:12787:dylib/libusbmuxd.2.dylib:12787:34784:0:0:4049218369:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-d3d869483c523ab4270d2c84adf68623.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 9efb552097cf4a408ea3bab4aa2bc957 is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 15 > LibClamAV debug: MACHO: Size of load commands: 1688 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0xce0 > LibClamAV debug: MACHO: Virtual size: 13164 > LibClamAV debug: MACHO: Raw size: 13168 > LibClamAV debug: MACHO: File offset: 3296 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x404c > LibClamAV debug: MACHO: Virtual size: 312 > LibClamAV debug: MACHO: Raw size: 312 > LibClamAV debug: MACHO: File offset: 16460 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x4184 > LibClamAV debug: MACHO: Virtual size: 536 > LibClamAV debug: MACHO: Raw size: 536 > LibClamAV debug: MACHO: File offset: 16772 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x43a0 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 17312 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x43b0 > LibClamAV debug: MACHO: Virtual size: 2858 > LibClamAV debug: MACHO: Raw size: 2858 > LibClamAV debug: MACHO: File offset: 17328 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x4eda > LibClamAV debug: MACHO: Virtual size: 216 > LibClamAV debug: MACHO: Raw size: 216 > LibClamAV debug: MACHO: File offset: 20186 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x4fb8 > LibClamAV debug: MACHO: Virtual size: 72 > LibClamAV debug: MACHO: Raw size: 72 > LibClamAV debug: MACHO: File offset: 20408 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 6 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x5000 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 20480 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x5010 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 20496 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x5020 > LibClamAV debug: MACHO: Virtual size: 416 > LibClamAV debug: MACHO: Raw size: 416 > LibClamAV debug: MACHO: File offset: 20512 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0x51c0 > LibClamAV debug: MACHO: Virtual size: 12 > LibClamAV debug: MACHO: Raw size: 12 > LibClamAV debug: MACHO: File offset: 20928 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0x51d0 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __common > LibClamAV debug: MACHO: Virtual address: 0x51f8 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 9efb552097cf4a408ea3bab4aa2bc957 (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12383952 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libxml2.2.dylib:1157260:528325:208d58d7:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:528325:dylib/libxml2.2.dylib:528325:1157260:0:0:546134231:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-1575b49e42f74de9579d845ea3a2906e.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 34f14463f28d11bd0299f0d7a3985718 is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 17 > LibClamAV debug: MACHO: Size of load commands: 1880 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x2840 > LibClamAV debug: MACHO: Virtual size: 824172 > LibClamAV debug: MACHO: Raw size: 824172 > LibClamAV debug: MACHO: File offset: 10304 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0xcbbac > LibClamAV debug: MACHO: Virtual size: 666 > LibClamAV debug: MACHO: Raw size: 666 > LibClamAV debug: MACHO: File offset: 834476 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0xcbe48 > LibClamAV debug: MACHO: Virtual size: 1126 > LibClamAV debug: MACHO: Raw size: 1128 > LibClamAV debug: MACHO: File offset: 835144 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0xcc2b0 > LibClamAV debug: MACHO: Virtual size: 103898 > LibClamAV debug: MACHO: Raw size: 103904 > LibClamAV debug: MACHO: File offset: 836272 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0xe5890 > LibClamAV debug: MACHO: Virtual size: 14752 > LibClamAV debug: MACHO: Raw size: 14752 > LibClamAV debug: MACHO: File offset: 940176 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0xe9230 > LibClamAV debug: MACHO: Virtual size: 6564 > LibClamAV debug: MACHO: Raw size: 6564 > LibClamAV debug: MACHO: File offset: 954928 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0xeabd8 > LibClamAV debug: MACHO: Virtual size: 1056 > LibClamAV debug: MACHO: Raw size: 1056 > LibClamAV debug: MACHO: File offset: 961496 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0xeb000 > LibClamAV debug: MACHO: Virtual size: 136 > LibClamAV debug: MACHO: Raw size: 136 > LibClamAV debug: MACHO: File offset: 962560 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0xeb088 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 962696 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0xeb098 > LibClamAV debug: MACHO: Virtual size: 888 > LibClamAV debug: MACHO: Raw size: 888 > LibClamAV debug: MACHO: File offset: 962712 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0xeb410 > LibClamAV debug: MACHO: Virtual size: 29712 > LibClamAV debug: MACHO: Raw size: 29712 > LibClamAV debug: MACHO: File offset: 963600 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0xf2820 > LibClamAV debug: MACHO: Virtual size: 5088 > LibClamAV debug: MACHO: Raw size: 5088 > LibClamAV debug: MACHO: File offset: 993312 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0xf3c00 > LibClamAV debug: MACHO: Virtual size: 4816 > LibClamAV debug: MACHO: Raw size: 4816 > LibClamAV debug: MACHO: --- Section 13 --- > LibClamAV debug: MACHO: Name: __common > LibClamAV debug: MACHO: Virtual address: 0xf4ed0 > LibClamAV debug: MACHO: Virtual size: 200 > LibClamAV debug: MACHO: Raw size: 200 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: Matched signature for file type HTML data at 859903 > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: 34f14463f28d11bd0299f0d7a3985718 (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12912356 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:dylib/libz.1.dylib:76404:40317:d14d198d:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:40317:dylib/libz.1.dylib:40317:76404:0:0:3511490957:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-fb77408fd63da2f33284af4a92e821f2.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: f2b19c7a58e303f0a159a44d08c6df63 is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Dynamically bound shared library > LibClamAV debug: MACHO: Number of load commands: 14 > LibClamAV debug: MACHO: Size of load commands: 1544 > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 7 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x12c0 > LibClamAV debug: MACHO: Virtual size: 43181 > LibClamAV debug: MACHO: Raw size: 43184 > LibClamAV debug: MACHO: File offset: 4800 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0xbb6e > LibClamAV debug: MACHO: Virtual size: 96 > LibClamAV debug: MACHO: Raw size: 96 > LibClamAV debug: MACHO: File offset: 47982 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0xbbd0 > LibClamAV debug: MACHO: Virtual size: 176 > LibClamAV debug: MACHO: Raw size: 176 > LibClamAV debug: MACHO: File offset: 48080 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0xbc80 > LibClamAV debug: MACHO: Virtual size: 15692 > LibClamAV debug: MACHO: Raw size: 15696 > LibClamAV debug: MACHO: File offset: 48256 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0xf9cc > LibClamAV debug: MACHO: Virtual size: 810 > LibClamAV debug: MACHO: Raw size: 810 > LibClamAV debug: MACHO: File offset: 63948 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0xfcf6 > LibClamAV debug: MACHO: Virtual size: 404 > LibClamAV debug: MACHO: Raw size: 404 > LibClamAV debug: MACHO: File offset: 64758 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0xfe90 > LibClamAV debug: MACHO: Virtual size: 360 > LibClamAV debug: MACHO: Raw size: 360 > LibClamAV debug: MACHO: File offset: 65168 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 5 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x10000 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 65536 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x10010 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 65552 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x10018 > LibClamAV debug: MACHO: Virtual size: 128 > LibClamAV debug: MACHO: Raw size: 128 > LibClamAV debug: MACHO: File offset: 65560 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x100a0 > LibClamAV debug: MACHO: Virtual size: 240 > LibClamAV debug: MACHO: Raw size: 240 > LibClamAV debug: MACHO: File offset: 65696 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0x10190 > LibClamAV debug: MACHO: Virtual size: 96 > LibClamAV debug: MACHO: Raw size: 96 > LibClamAV debug: MACHO: File offset: 65936 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: cli_magic_scandesc: returning 0 at line 2470 > LibClamAV debug: cache_add: f2b19c7a58e303f0a159a44d08c6df63 (level 0) > LibClamAV debug: ZIP/ZIP-SFX signature found at 12952749 > LibClamAV debug: in cli_unzip_single > LibClamAV debug: cli_unzip: lh - > ZMDNAME:0:globalupdate:227144:64067:9cde528:8:0:1 > LibClamAV debug: > CDBNAME:CL_TYPE_ZIP:64067:globalupdate:64067:227144:0:0:164488488:0x0 > LibClamAV debug: cli_unzip: extracted to > /var/folders/95/mfq7sh888xl0c_008k8bty_h0000gv/T//clamav-bfed3342516879dec1d4da3e028aec98.tmp > LibClamAV debug: in cli_magic_scandesc (reclevel: 1/16) > LibClamAV debug: Recognized Mach-O LE 64-bit file > LibClamAV debug: cache_check: 9037cf29ed485dae11e22955724a00e7 is negative > LibClamAV debug: MACHO: CPU Type: Intel 64-bit > LibClamAV debug: MACHO: Filetype: Executable > LibClamAV debug: MACHO: Number of load commands: 24 > LibClamAV debug: MACHO: Size of load commands: 4352 > LibClamAV debug: MACHO: Segment name: __PAGEZERO > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __TEXT > LibClamAV debug: MACHO: Number of sections: 12 > LibClamAV debug: MACHO: --- Section 0 --- > LibClamAV debug: MACHO: Name: __text > LibClamAV debug: MACHO: Virtual address: 0x14c0 > LibClamAV debug: MACHO: Virtual size: 66111 > LibClamAV debug: MACHO: Raw size: 66112 > LibClamAV debug: MACHO: File offset: 5312 > LibClamAV debug: MACHO: --- Section 1 --- > LibClamAV debug: MACHO: Name: __stubs > LibClamAV debug: MACHO: Virtual address: 0x11700 > LibClamAV debug: MACHO: Virtual size: 510 > LibClamAV debug: MACHO: Raw size: 510 > LibClamAV debug: MACHO: File offset: 71424 > LibClamAV debug: MACHO: --- Section 2 --- > LibClamAV debug: MACHO: Name: __stub_helper > LibClamAV debug: MACHO: Virtual address: 0x11900 > LibClamAV debug: MACHO: Virtual size: 866 > LibClamAV debug: MACHO: Raw size: 868 > LibClamAV debug: MACHO: File offset: 71936 > LibClamAV debug: MACHO: --- Section 3 --- > LibClamAV debug: MACHO: Name: __objc_methname > LibClamAV debug: MACHO: Virtual address: 0x11c62 > LibClamAV debug: MACHO: Virtual size: 10237 > LibClamAV debug: MACHO: Raw size: 10237 > LibClamAV debug: MACHO: File offset: 72802 > LibClamAV debug: MACHO: --- Section 4 --- > LibClamAV debug: MACHO: Name: __objc_classnam > LibClamAV debug: MACHO: Virtual address: 0x1445f > LibClamAV debug: MACHO: Virtual size: 252 > LibClamAV debug: MACHO: Raw size: 252 > LibClamAV debug: MACHO: File offset: 83039 > LibClamAV debug: MACHO: --- Section 5 --- > LibClamAV debug: MACHO: Name: __objc_methtype > LibClamAV debug: MACHO: Virtual address: 0x1455b > LibClamAV debug: MACHO: Virtual size: 1724 > LibClamAV debug: MACHO: Raw size: 1724 > LibClamAV debug: MACHO: File offset: 83291 > LibClamAV debug: MACHO: --- Section 6 --- > LibClamAV debug: MACHO: Name: __cstring > LibClamAV debug: MACHO: Virtual address: 0x14c20 > LibClamAV debug: MACHO: Virtual size: 5388 > LibClamAV debug: MACHO: Raw size: 5392 > LibClamAV debug: MACHO: File offset: 85024 > LibClamAV debug: MACHO: --- Section 7 --- > LibClamAV debug: MACHO: Name: __ustring > LibClamAV debug: MACHO: Virtual address: 0x1612c > LibClamAV debug: MACHO: Virtual size: 12 > LibClamAV debug: MACHO: Raw size: 12 > LibClamAV debug: MACHO: File offset: 90412 > LibClamAV debug: MACHO: --- Section 8 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x16140 > LibClamAV debug: MACHO: Virtual size: 320 > LibClamAV debug: MACHO: Raw size: 320 > LibClamAV debug: MACHO: File offset: 90432 > LibClamAV debug: MACHO: --- Section 9 --- > LibClamAV debug: MACHO: Name: __gcc_except_ta > LibClamAV debug: MACHO: Virtual address: 0x16280 > LibClamAV debug: MACHO: Virtual size: 2128 > LibClamAV debug: MACHO: Raw size: 2128 > LibClamAV debug: MACHO: File offset: 90752 > LibClamAV debug: MACHO: --- Section 10 --- > LibClamAV debug: MACHO: Name: __unwind_info > LibClamAV debug: MACHO: Virtual address: 0x16ad0 > LibClamAV debug: MACHO: Virtual size: 1016 > LibClamAV debug: MACHO: Raw size: 1016 > LibClamAV debug: MACHO: File offset: 92880 > LibClamAV debug: MACHO: --- Section 11 --- > LibClamAV debug: MACHO: Name: __eh_frame > LibClamAV debug: MACHO: Virtual address: 0x16ec8 > LibClamAV debug: MACHO: Virtual size: 16688 > LibClamAV debug: MACHO: Raw size: 16688 > LibClamAV debug: MACHO: File offset: 93896 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __DATA > LibClamAV debug: MACHO: Number of sections: 21 > LibClamAV debug: MACHO: --- Section 12 --- > LibClamAV debug: MACHO: Name: __program_vars > LibClamAV debug: MACHO: Virtual address: 0x1b000 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: File offset: 110592 > LibClamAV debug: MACHO: --- Section 13 --- > LibClamAV debug: MACHO: Name: __nl_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x1b028 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 110632 > LibClamAV debug: MACHO: --- Section 14 --- > LibClamAV debug: MACHO: Name: __got > LibClamAV debug: MACHO: Virtual address: 0x1b038 > LibClamAV debug: MACHO: Virtual size: 208 > LibClamAV debug: MACHO: Raw size: 208 > LibClamAV debug: MACHO: File offset: 110648 > LibClamAV debug: MACHO: --- Section 15 --- > LibClamAV debug: MACHO: Name: __la_symbol_ptr > LibClamAV debug: MACHO: Virtual address: 0x1b108 > LibClamAV debug: MACHO: Virtual size: 680 > LibClamAV debug: MACHO: Raw size: 680 > LibClamAV debug: MACHO: File offset: 110856 > LibClamAV debug: MACHO: --- Section 16 --- > LibClamAV debug: MACHO: Name: __const > LibClamAV debug: MACHO: Virtual address: 0x1b3b0 > LibClamAV debug: MACHO: Virtual size: 1712 > LibClamAV debug: MACHO: Raw size: 1712 > LibClamAV debug: MACHO: File offset: 111536 > LibClamAV debug: MACHO: --- Section 17 --- > LibClamAV debug: MACHO: Name: __objc_classlis > LibClamAV debug: MACHO: Virtual address: 0x1ba60 > LibClamAV debug: MACHO: Virtual size: 24 > LibClamAV debug: MACHO: Raw size: 24 > LibClamAV debug: MACHO: File offset: 113248 > LibClamAV debug: MACHO: --- Section 18 --- > LibClamAV debug: MACHO: Name: __objc_nlclslis > LibClamAV debug: MACHO: Virtual address: 0x1ba78 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 113272 > LibClamAV debug: MACHO: --- Section 19 --- > LibClamAV debug: MACHO: Name: __objc_catlist > LibClamAV debug: MACHO: Virtual address: 0x1ba80 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: File offset: 113280 > LibClamAV debug: MACHO: --- Section 20 --- > LibClamAV debug: MACHO: Name: __objc_protolis > LibClamAV debug: MACHO: Virtual address: 0x1baa8 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: File offset: 113320 > LibClamAV debug: MACHO: --- Section 21 --- > LibClamAV debug: MACHO: Name: __objc_imageinf > LibClamAV debug: MACHO: Virtual address: 0x1bad0 > LibClamAV debug: MACHO: Virtual size: 8 > LibClamAV debug: MACHO: Raw size: 8 > LibClamAV debug: MACHO: File offset: 113360 > LibClamAV debug: MACHO: --- Section 22 --- > LibClamAV debug: MACHO: Name: __objc_const > LibClamAV debug: MACHO: Virtual address: 0x1bad8 > LibClamAV debug: MACHO: Virtual size: 11616 > LibClamAV debug: MACHO: Raw size: 11616 > LibClamAV debug: MACHO: File offset: 113368 > LibClamAV debug: MACHO: --- Section 23 --- > LibClamAV debug: MACHO: Name: __objc_selrefs > LibClamAV debug: MACHO: Virtual address: 0x1e838 > LibClamAV debug: MACHO: Virtual size: 2848 > LibClamAV debug: MACHO: Raw size: 2848 > LibClamAV debug: MACHO: File offset: 124984 > LibClamAV debug: MACHO: --- Section 24 --- > LibClamAV debug: MACHO: Name: __objc_protoref > LibClamAV debug: MACHO: Virtual address: 0x1f358 > LibClamAV debug: MACHO: Virtual size: 16 > LibClamAV debug: MACHO: Raw size: 16 > LibClamAV debug: MACHO: File offset: 127832 > LibClamAV debug: MACHO: --- Section 25 --- > LibClamAV debug: MACHO: Name: __objc_classref > LibClamAV debug: MACHO: Virtual address: 0x1f368 > LibClamAV debug: MACHO: Virtual size: 288 > LibClamAV debug: MACHO: Raw size: 288 > LibClamAV debug: MACHO: File offset: 127848 > LibClamAV debug: MACHO: --- Section 26 --- > LibClamAV debug: MACHO: Name: __objc_superref > LibClamAV debug: MACHO: Virtual address: 0x1f488 > LibClamAV debug: MACHO: Virtual size: 40 > LibClamAV debug: MACHO: Raw size: 40 > LibClamAV debug: MACHO: File offset: 128136 > LibClamAV debug: MACHO: --- Section 27 --- > LibClamAV debug: MACHO: Name: __objc_data > LibClamAV debug: MACHO: Virtual address: 0x1f4b0 > LibClamAV debug: MACHO: Virtual size: 320 > LibClamAV debug: MACHO: Raw size: 320 > LibClamAV debug: MACHO: File offset: 128176 > LibClamAV debug: MACHO: --- Section 28 --- > LibClamAV debug: MACHO: Name: __cfstring > LibClamAV debug: MACHO: Virtual address: 0x1f5f0 > LibClamAV debug: MACHO: Virtual size: 3840 > LibClamAV debug: MACHO: Raw size: 3840 > LibClamAV debug: MACHO: File offset: 128496 > LibClamAV debug: MACHO: --- Section 29 --- > LibClamAV debug: MACHO: Name: __objc_ivar > LibClamAV debug: MACHO: Virtual address: 0x204f0 > LibClamAV debug: MACHO: Virtual size: 472 > LibClamAV debug: MACHO: Raw size: 472 > LibClamAV debug: MACHO: File offset: 132336 > LibClamAV debug: MACHO: --- Section 30 --- > LibClamAV debug: MACHO: Name: __data > LibClamAV debug: MACHO: Virtual address: 0x206d0 > LibClamAV debug: MACHO: Virtual size: 712 > LibClamAV debug: MACHO: Raw size: 720 > LibClamAV debug: MACHO: File offset: 132816 > LibClamAV debug: MACHO: --- Section 31 --- > LibClamAV debug: MACHO: Name: __common > LibClamAV debug: MACHO: Virtual address: 0x20998 > LibClamAV debug: MACHO: Virtual size: 32 > LibClamAV debug: MACHO: Raw size: 32 > LibClamAV debug: MACHO: --- Section 32 --- > LibClamAV debug: MACHO: Name: __bss > LibClamAV debug: MACHO: Virtual address: 0x209b8 > LibClamAV debug: MACHO: Virtual size: 32 > LibClamAV debug: MACHO: Raw size: 32 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: MACHO: Segment name: __LINKEDIT > LibClamAV debug: MACHO: Number of sections: 0 > LibClamAV debug: MACHO: ------------------ > LibClamAV debug: hashtab: Freeing hashset, elements: 0, capacity: 0 > LibClamAV debug: OSX.MacHook/WireLurker.A.UNOFFICIAL found > LibClamAV debug: FP SIGNATURE: > 9037cf29ed485dae11e22955724a00e7:227144:OSX.MacHook/WireLurker.A.UNOFFICIAL > LibClamAV debug: cli_magic_scandesc: returning 1 at line 2470 > LibClamAV debug: OSX.MacHook/WireLurker.A.UNOFFICIAL found > LibClamAV debug: FP SIGNATURE: > 819dfe85859c382bfc80a5537b5241c1:25615619:OSX.MacHook/WireLurker.A.UNOFFICIAL > LibClamAV debug: cli_magic_scandesc: returning 1 at line 2470 > /Volumes/Macintosh HD/Users/avarnell/Documents/CleanApp 4.0.8 Mac 中文版.dmg: > OSX.MacHook/WireLurker.A.UNOFFICIAL FOUND > LibClamAV debug: Cleaning up phishcheck > LibClamAV debug: Freeing phishcheck struct > LibClamAV debug: Phishcheck cleaned up > > ----------- SCAN SUMMARY ----------- > Known viruses: 3778735 > Engine version: 0.98.6 > Scanned directories: 0 > Scanned files: 1 > Infected files: 1 > Data scanned: 27.74 MB > Data read: 24.43 MB (ratio 1.14:1) > Time: 9.418 sec (0 m 9 s) When mounting CleanApp 4.0.8 Mac 中文版.dmg Sentry located: /Volumes/CleanApp 4.0.8 Mac 中文版/CleanApp.app/Contents/MacOS/CleanApp: OSX.MacHook/WireLurker.UNOFFICIAL FOUND /Volumes/CleanApp 4.0.8 Mac 中文版/CleanApp.app/Contents/Resources/FontMap1.cfg: OSX.MacHook/WireLurker.A.UNOFFICIAL FOUND /Volumes/CleanApp 4.0.8 Mac 中文版/CleanApp.app/Contents/Resources/start.sh: OSX.MacHook/WireLurker.UNOFFICIAL FOUND ====== So three somewhat different results for the three .dmg files leads me to believe that bursting is possible, but no evidence of being able to detect infected files within a .dmg container. -Al- On Fri, Mar 27, 2015 at 08:25AM, Dennis Peterson wrote: > > Are the image files scanned as a single binary or are they burst like other > archives into discreet files and then scanned? I guess the question really is > against what would signatures be written when dealing with disk images. > > dp > > On 3/27/15 4:45 AM, Joel Esler (jesler) wrote: >> Dmg scanning was added a couple of versions back. >> >> -- >> Joel Esler >> Sent from my iPhone >> >> On Mar 27, 2015, at 3:11 AM, Al Varnell >> <alvarn...@mac.com<mailto:alvarn...@mac.com>> wrote: >> >> >> On Thu, Mar 26, 2015 at 11:17PM, Dennis Peterson wrote: >> >> Forgot to include dmg files are as described when mounted - else they are >> disk images (cpio). I don't know what the clam product does with unmounted >> disk images. >> >> dp >> >> That’s correct. There have been a handful (nine) .dmg hash signatures quite >> awhile ago and I’ve handled a couple of false positives, but there is no >> attempt to check the image contents which would almost certainly require >> mounting. I believe they are simply scanned as a generic file. >> >> -Al- >> >> On 3/26/15 11:09 PM, Dennis Peterson wrote: >> The dmg files are logical structures. They are comprised of Unix directories >> and files and clam doesn't need to treat them differently than any other >> directory tree. if you have support compiled in for zip, RAR, TAR, and >> several other archiving formats it should decompose them and scan each of >> the the contents. You should be able to explore the log to see what clamXav >> did while scanning. >> >> dp >> >> On 3/26/15 10:44 PM, Jinwon Lee wrote: >> Hi >> >> I am a new member. >> >> I am a Mac user and so I use ClamXav to scan my files. >> >> My question is: >> >> ‘Does ClamXav scan what’s inside Compressed files like .RAR, .zip…. and >> Package files like .dmg?’ Because I feel ClamXav takes >> considerably longer to scan the extracted file/s compared to the compressed >> versions and wonder if it really scans them. >> >> Kind Regards >> Jinwon _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
