Mark wrote: > Chris,
>> When I start amavisd-new I see the following: >> Oct 6 11:20:50 grettir amavis[12701]: Internal decoder for .zip >> Is there another type of decoder that can be used for .zip? > No there isn't another zip decoder for the moment. > The Archive::Zip is doing its job quite well, > so I never bothered with providing alternatives. > Just keep the Archive::Zip and Compress::Zlib > reasonably recent. > Mark Oct 5 18:05:42 sf8 amavis[6312]: (06312-04) do_executable/do_unzip failed, ignoring: format error: bad signature: 0x00905a4d at offset 0 in file /var/lib/amavis/amavis-20051005T165720-06312/parts/p004 Oct 5 18:05:50 sf8 amavis[6312]: (06312-04) Blocked BANNED (multipart/mixed | application/octet-stream,.zip,pword_change.zip | .exe,.exe-ms,PW_Klass.Pic.packed-bitmap.exe | PW_Klass.Pic.packed-bitmap.exe), LOCAL [10.10.10.13] [213.165.64.20] <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, quarantine: [EMAIL PROTECTED], Message-ID: <[EMAIL PROTECTED]>, mail_id: twvrh8bxFLNq, Hits: -, 8331 ms Chris, did you maybe see something like this recently? I got a fresh new (undetected) virus last night that did this. I block .zip files, so I'm not sure if this was blocked because it was a .zip file, or if the .exe triggered it. Since it gave what looks like the file name of what was inside the zip, I would assume that even though it says the unzip failed, it was able to recognize the contents. I admit it confuses me. I have to believe it would have been blocked, even if I did not block .zip files. I'm using version 1.14. Gary V ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
