| LibClamAV Warning: ************************************************** | |
| LibClamAV Warning: *** The virus database is older than 7 days! *** | |
| LibClamAV Warning: *** Please update it as soon as possible. *** | |
| LibClamAV Warning: ************************************************** | |
| Initializing the engine (devel-20071218) | |
| Initializing phishcheck module | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck: Compiling regex: %s | |
| Phishcheck module initialized | |
| cli_loaddbdir: Acquiring dbdir lock | |
| Loading databases from %s | |
| in cli_cvdload() | |
| MD5(.tar.gz) = %s | |
| in cli_untgz() | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_untgz: Unpacking %s | |
| cli_loaddbdir: Acquiring dbdir lock | |
| Loading databases from %s | |
| %s loaded | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| Initializing engine->root[%d] | |
| Initialising AC pattern matcher of root[%d] | |
| cli_initroots: Initializing BM tables of root[%d] | |
| %s loaded | |
| cli_loadmd5: Initializing MD5 list structure | |
| %s loaded | |
| %s loaded | |
| %s skipped | |
| %s loaded | |
| %s skipped | |
| %s loaded | |
| %s skipped | |
| Loading regex_list | |
| regex_list: Initialising AC pattern matcher | |
| Building regex list | |
| %s loaded | |
| Loading regex_list | |
| regex_list: Initialising AC pattern matcher | |
| Building regex list | |
| %s loaded | |
| %s loaded | |
| %s loaded | |
| Dynamic engine configuration settings: | |
| -------------------------------------- | |
| Module PE: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Module ELF: %s | |
| Module ARCHIVE: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Module DOCUMENT: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Module MAIL: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Module OTHER: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Module PHISHING %s | |
| * Submodule %10s: %s | |
| * Submodule %10s: %s | |
| Scanning clam.cab | |
| Recognized %s file | |
| in cli_scanmscab() | |
| CAB: -------------- Cabinet file ---------------- | |
| CAB: Cabinet length: %u | |
| CAB: Folders: %u | |
| CAB: Files: %u | |
| CAB: File format version: %u.%u | |
| CAB: Folder record %u | |
| CAB: Folder offset: %u | |
| CAB: Folder compression method: %d | |
| CAB: File record %u | |
| CAB: File name: %s | |
| CAB: File offset: %u | |
| CAB: File folder index: %u | |
| CAB: File attribs: 0x%x | |
| CAB: * file modified since last backup | |
| CAB: Extracting file %s to %s, size %u | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| clam.cab: OK | |
| Scanning clamdoc.tar.gz | |
| Recognized %s file | |
| in cli_scangzip() | |
| Recognized POSIX tar file | |
| in cli_scantar() | |
| In untar(%s, %d) | |
| cli_untar: size = %d | |
| cli_untar: extracting %s | |
| Recognized %s file | |
| in cli_pdf(%s) | |
| cli_pdf: scanning %lu bytes | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| Length is in indirect obj %ld | |
| length in '%s' %ld | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: writing %lu bytes from the stream | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| length %ld, calculated_streamlen %ld isFlate %d isASCII85 %d | |
| cli_pdf: flatedecode %lu bytes | |
| cli_pdf: flatedecode in=%lu out=%lu ratio %lu (max %u) | |
| cli_pdf: extracted file %d to %s | |
| cli_pdf: returning %d | |
| Recognized %s file | |
| in cli_check_jpeg_exploit() | |
| clamdoc.tar.gz: OK | |
| Scanning clam.exe | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| clam.exe: OK | |
| Scanning clam.exe.bz2 | |
| Recognized %s file | |
| clam.exe.bz2: OK | |
| Scanning clam-v2.rar | |
| LibClamAV Warning: RAR code not compiled-in | |
| Recognized %s file | |
| clam-v2.rar: OK | |
| Scanning clam-v3.rar | |
| LibClamAV Warning: RAR code not compiled-in | |
| Recognized %s file | |
| clam-v3.rar: OK | |
| Scanning clam.zip | |
| Recognized %s file | |
| in scanzip() | |
| Unzip: __zip_find_disk_trailer: found file header at %u, shift %u | |
| Zip: %s, crc32: 0x%x, offset: %u, encrypted: %u, compressed: %u, normal: %u, method: %u, ratio: %u (max: %u) | |
| Zip: File decompressed to %s | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| Matched signature for file type %s at %u | |
| clam.zip: OK | |
| Scanning README | |
| README: OK | |
| Scanning Doc11.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| macro offset: 0x%.4x | |
| macro len: 0x%.4x | |
| read macro_info failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| Doc11.rtf: OK | |
| Scanning Doc1.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Small data (%u bytes) | |
| Doc1.rtf: OK | |
| Scanning Doc22.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| macro offset: 0x%.4x | |
| macro len: 0x%.4x | |
| read macro_info failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| Doc22.rtf: OK | |
| Scanning Doc2.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| macro offset: 0x%.4x | |
| macro len: 0x%.4x | |
| read macro_info failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| Doc2.rtf: OK | |
| Scanning doc3.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [dir ] | |
| b | |
| 0x%.8x 0x%.8x | |
| OLE2 dir entry: %s | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| macro offset: 0x%.4x | |
| macro len: 0x%.4x | |
| read macro_info failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| macro offset: 0x%.4x | |
| macro len: 0x%.4x | |
| read macro_info failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| Open WordDocument failed | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| doc3.rtf: OK | |
| Scanning docCLAMexe.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Small data (%u bytes) | |
| docCLAMexe.rtf: OK | |
| Scanning rtf1.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Small data (%u bytes) | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Recognized %s file | |
| e_lfanew == %d | |
| Machine type: 80386 | |
| NumberOfSections: %d | |
| TimeDateStamp: %s | |
| SizeOfOptionalHeader: %x | |
| File format: PE | |
| MajorLinkerVersion: %d | |
| MinorLinkerVersion: %d | |
| SizeOfCode: 0x%x | |
| SizeOfInitializedData: 0x%x | |
| SizeOfUninitializedData: 0x%x | |
| AddressOfEntryPoint: 0x%x | |
| BaseOfCode: 0x%x | |
| SectionAlignment: 0x%x | |
| FileAlignment: 0x%x | |
| MajorSubsystemVersion: %d | |
| MinorSubsystemVersion: %d | |
| SizeOfImage: 0x%x | |
| SizeOfHeaders: 0x%x | |
| NumberOfRvaAndSizes: %d | |
| Subsystem: Win32 GUI | |
| ------------------------------------ | |
| Section %d | |
| Section name: %s | |
| Section data (from headers - in memory) | |
| VirtualSize: 0x%x 0x%x | |
| VirtualAddress: 0x%x 0x%x | |
| SizeOfRawData: 0x%x 0x%x | |
| PointerToRawData: 0x%x 0x%x | |
| Section's memory is writeable | |
| ------------------------------------ | |
| EntryPoint offset: 0x%x (%d) | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Decoding ole object | |
| Small data (%u bytes) | |
| rtf1.rtf: OK | |
| Scanning rtf-novirus.rtf | |
| Recognized %s file | |
| in cli_scanrtf() | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| No macros detected | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| RTF: waiting for magic | |
| RTF: description length:%lu | |
| RTF: in WAIT_DESC | |
| Preparing to dump rtf embedded object, description:%s | |
| RTF: next state: wait_data_size | |
| RTF: in WAIT_DATA_SIZE | |
| Dumping rtf embedded object of size:%lu | |
| RTF: next state: DUMP_DATA | |
| RTF:Scanning embedded object:%s | |
| Recognized %s file | |
| in cli_scanole2() | |
| in cli_ole2_extract() | |
| mmap'ed file | |
| Magic: 0x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| CLSID: { | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| %x | |
| } | |
| Minor version: 0x%x | |
| DLL version: 0x%x | |
| Byte Order: %d | |
| Big Block Size: %i | |
| Small Block Size: %i | |
| BAT count: %d | |
| Prop start: %d | |
| SBAT cutoff: %d | |
| SBat start: %d | |
| SBat block count: %d | |
| XBat start: %d | |
| XBat block count: %d | |
| Max block number: %lu | |
| %34s | |
| [root] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| b | |
| 0x%.8x 0x%.8x | |
| %34s | |
| [file] | |
| r | |
| 0x%.8x 0x%.8x | |
| VBADir: %s | |
| in vba56_dir_read() | |
| Can't open %s | |
| Open PowerPoint Document failed | |
| No macros detected | |
| RTF: waiting for magic | |
| Warning: rtf objdata magic number not matched, expected:%d, got: %d, at pos:%lu | |
| rtf-novirus.rtf: OK | |
| Cleaning up phishcheck | |
| Freeing phishcheck struct | |
| Phishcheck cleaned up | |
| ----------- SCAN SUMMARY ----------- | |
| Known viruses: 19590 | |
| Engine version: devel-20071218 | |
| Scanned directories: 0 | |
| Scanned files: 16 | |
| Infected files: 0 | |
| Data scanned: 1.89 MB | |
| exit 0 |