Hi, I understand that the AFC_Plugin could find attachments in a file like "zip". AFC will open by a max decompression level of 10 and find out files from "attachment blocking". If there is some of these files found, the mail will blocked by ASSP. Actually attachments are blocked by "Attachment blocking" if the block-file is not in a zip file.
Now I have tested these function by my site, because I have received a zip file without encryption/password which has a ".doc.js" script inside I don't want. Martin -----Ursprüngliche Nachricht----- Von: Thomas Eckardt [mailto:thomas.ecka...@thockar.com] Gesendet: Dienstag, 9. Februar 2016 16:30 An: ASSP development mailing list Betreff: Re: [Assp-test] fixes in assp 2.4.8 build 16036 What did you not understand, if you read the GUI for the Plugin, ClamAV, attachment blocking? Thomas Von: Martin Voßloh <martin.voss...@mhp.com> An: ASSP development mailing list <assp-test@lists.sourceforge.net> Datum: 09.02.2016 15:24 Betreff: Re: [Assp-test] fixes in assp 2.4.8 build 16036 Hello, I use the assp 2.4.8 build 16036 with ClamAV and AFC Plugin. If I send me a testmail from anonymous account with an attachment name.zip without password an with a file called name2.doc.js it will not be blocked by the plugin. Bad Attachment is enabled with the default endings except .js How could I check this plugin for missing dependencies? Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de orbit.eternalimpact.info - no MX record found - (NOERROR) Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] [MissingMX] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de [[scoring]] MX missing: beck.fr (From) Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de Message-Score: added 10 (mxValencePB) for MX missing: beck.fr (From), total score for this message is now 10 Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] [MissingMXA] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de [[scoring]] A record missing: beck.fr (From) Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de deleting spamming safelisted tuplet: (37.48.122.0,orbit.eternalimpact.info) age: 0s Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de Message-Score: added 15 (mxaValencePB) for A record missing: beck.fr (From), total score for this message is now 25 Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] [MissingMX] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de [[scoring]] MX missing: orbit.eternalimpact.info (Mail From:) Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de Bayesian Check - Prob: 0.00000 => ham - answer/query relation: 23% of 26 Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de [Plugin] calling plugin ASSP_AFC Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de info: 1 attachment found for Level-1 Feb-09-16 14:38:18 m1-25098-12141 [Worker_8] [TLS-in] [TLS-out] [MessageOK] 37.48.122.29 <anon...@orbit.eternalimpact.info> to: mvoss...@mhp.de message ok [Michi testet 25] Regards Martin ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140 _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140 _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
