> Chris, did you maybe see something like this recently? I > got a fresh new (undetected) virus last night that did this. > > Oct 5 18:05:42 sf8 amavis[6312]: (06312-04) > do_executable/do_unzip failed, ignoring: format error: > bad signature: 0x00905a4d at offset 0 in file > /var/lib/amavis/amavis-20051005T165720-06312/parts/p004 > > Oct 5 18:05:50 sf8 amavis[6312]: (06312-04) Blocked > BANNED (multipart/mixed | > application/octet-stream,.zip,pword_change.zip | > .exe,.exe-ms,PW_Klass.Pic.packed-bitmap.exe | > PW_Klass.Pic.packed-bitmap.exe), LOCAL [10.10.10.13] > [213.165.64.20] <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, > quarantine: [EMAIL PROTECTED], Message-ID: > <[EMAIL PROTECTED]>, mail_id: > twvrh8bxFLNq, Hits: -, 8331 ms
Yeah I've gotten similar ones. This was a recent thread on postfix-users as well. I don't block zip, but I block windows executables within compressed archives. amavisd-new picks up executables within encrypted zips as well. I also block message/partial message/external-body RFC2046 MIME types. I'm debating whether or not to ban zip - some users use .zip to send large files. I've noticed a lot of our business partners don't allow .zip either out of extreme caution or because of primitive filters which can't inspect zip content. What do you on these lists do? --- Chris Covington IT Plus One Health Management 75 Maiden Lane Suite 801 New York, NY 10038 646-312-6269 http://www.plusoneactive.com ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
