On Thu, 05 Feb 2015 13:33:52 +0100, Benny Pedersen <m...@junc.eu> wrote:
>
> google foxhole clamav
>
Well, foxhole is something I never thought to Google:)
>
> my question will be what happen in clamav if scr is double packed with
> zip ?
>
Clamav does unpack archives recursively up to 16 levels (by default).
For clamd it is set with MaxRecursion configuration value, for clamscan
with --max-recursion=N command line switch. So that rule matches still.
And I do doubt, that such viruses are hidden deeper. I would at
least think, that odds of users accidentally executing such file would
decrease with deeper nesting.
--
Virgo Pärna
virgo.pa...@mail.ee
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
