1

If an Antivirus (ex:ESET) detects a virus inside an archive (ex: .RAR) will it automatically delete the infected file? Or would I need to delete the whole archive? (assuming the archive is not password protected)

3
  • 1
    It is absolutely possible for AV software to do that - they already know the archive format, because they scan archived files, and for most libraries (.RAR is an exception) basically all libraries usable for scanning can do modification too - but I don't know if any actually would do that. Why do you ask?
    – CBHacking
    Commented Mar 12, 2017 at 8:43
  • @CBHacking I asked just for curiosity! How would I know if the Antivirus ha effectively deleted the files?
    – Denis
    Commented Mar 12, 2017 at 8:56
  • 2
    Test it. There is a harmless virus scanner test fie, the EICAR test virus. Pack it into an archive and see how your virus scanner of choice deals with it. Commented Mar 12, 2017 at 9:07

2 Answers 2

1

Commonly AV detect only malware but not remove it from inside an archive. If this feature would be needed the AV would not only need to implement functionality to look into an archive but also to create a new archive, this way making the code more complex.
But, there are for example firewalls which remove malicious content from the traffic (i.e. drop attachment from mail) or even change the content by stripping macros from an office document before forwarding it.

1
  • I have also seen emails with zip files that have been altered by antivirus software (malicious files inside the zip removed). From my experience, this is not very common, however.
    – Lukas
    Commented Mar 12, 2017 at 12:57
1

Most modern Antivirus Software can repair a compressed File containing a Virus.

Often this option is turned off due to the length of time it adds to each Scan (or only the Initial Scan, a feature offered by a few Programs). The Checkbox 'Scan on Demand' will detect the Virus at 'unpacking time' (often with updated Antivirus Definitions, and Engine) and save time with a better Detection Rate.

The 16 year old answer is "yes": https://www.symantec.com/connect/articles/infectable-objects-part-four-viruses-archive-files-and-compressed-files - in the past decade great improvements have been made on both sides; at the very least deletion of the viral files within the Archive is possible and deletion of the whole File is unnecessary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .