If an Antivirus (ex:ESET) detects a virus inside an archive (ex: .RAR) will it automatically delete the infected file? Or would I need to delete the whole archive? (assuming the archive is not password protected)
3
-
1It is absolutely possible for AV software to do that - they already know the archive format, because they scan archived files, and for most libraries (.RAR is an exception) basically all libraries usable for scanning can do modification too - but I don't know if any actually would do that. Why do you ask?– CBHackingMar 12, 2017 at 8:43
-
@CBHacking I asked just for curiosity! How would I know if the Antivirus ha effectively deleted the files?– DenisMar 12, 2017 at 8:56
-
2Test it. There is a harmless virus scanner test fie, the EICAR test virus. Pack it into an archive and see how your virus scanner of choice deals with it.– Out of BandMar 12, 2017 at 9:07
Add a comment
|
2 Answers
Commonly AV detect only malware but not remove it from inside an archive. If this feature would be needed the AV would not only need to implement functionality to look into an archive but also to create a new archive, this way making the code more complex.
But, there are for example firewalls which remove malicious content from the traffic (i.e. drop attachment from mail) or even change the content by stripping macros from an office document before forwarding it.
answered Mar 12, 2017 at 10:07
-
I have also seen emails with zip files that have been altered by antivirus software (malicious files inside the zip removed). From my experience, this is not very common, however.– LukasMar 12, 2017 at 12:57
Most modern Antivirus Software can repair a compressed File containing a Virus.
Often this option is turned off due to the length of time it adds to each Scan (or only the Initial Scan, a feature offered by a few Programs). The Checkbox 'Scan on Demand' will detect the Virus at 'unpacking time' (often with updated Antivirus Definitions, and Engine) and save time with a better Detection Rate.
The 16 year old answer is "yes": https://www.symantec.com/connect/articles/infectable-objects-part-four-viruses-archive-files-and-compressed-files - in the past decade great improvements have been made on both sides; at the very least deletion of the viral files within the Archive is possible and deletion of the whole File is unnecessary.
