Huston, we have a problem!
It seems that new AFC plugin is treating .csv files as archive.....
*May-03-16 17:29:16 [Worker_4] Info: analyzing compressed file
/opt/assp/tmp/zip_4_1462289356/ITS01_2016W18.csv at zip-level 0*
*May-03-16 17:29:16 [Worker_4] Warning: possibly virus infected file (can't
extract archive) '/opt/assp/tmp/zip_4_1462289356/ITS01_2016W18.csv' - - *
*May-03-16 17:29:16 m1-89354-12457 [Worker_4] [TLS-in] [TLS-out]
[Attachment] 62.209.51.48 <clear_ad...@remote.tld> to: r...@local.tld SPAM
FOUND bad attachment 'ITS01_2016W18.csv' is a ' - the file extension:
'.csv' does not match the content based detected file type '''*
obviously csv is not a forbidden extention as attachment....
On Tue, May 3, 2016 at 1:59 PM, aquilinux <aquili...@gmail.com> wrote:
> 1) xz, lrz, lzma and 7z they all work:
>
> *May-03-16 13:47:40 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/vir.7z' - - *
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment 'vir.7z' is a ' - the file extension: '.xz' does not
> match the content based detected file type '''*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment 'vir.7z' is a ' - the file extension: '.xz'
> does not match the content based detected file type ''' with 'vir.txt'*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] *
>
> *May-03-16 13:47:40 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276060/vir.lzma' - - *
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment 'vir.lzma' is a ' - the file extension: '.lzma' does
> not match the content based detected file type '''*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment 'vir.lzma' is a ' - the file extension:
> '.lzma' does not match the content based detected file type ''' with
> 'vir.txt'*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment vir.tar.gz found for Level-1*
> *May-03-16 13:47:40 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> *May-03-16 13:47:39 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/53ddc8.js.lrz' -
> - *
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment '53ddc8.js.lrz' is a ' - the file extension: '.lrz'
> does not match the content based detected file type '''*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment '53ddc8.js.lrz' is a ' - the file extension:
> '.lrz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment 53ddc8.js.xz found for Level-1*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> *May-03-16 13:47:39 [Worker_1] Warning: possibly virus infected file
> (can't extract archive) '/opt/assp/tmp/zip_1_1462276059/53ddc8.js.xz' - - *
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND bad attachment '53ddc8.js.xz' is a ' - the file extension: '.xz' does
> not match the content based detected file type '''*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld SPAM
> FOUND replaced bad attachment '53ddc8.js.xz' is a ' - the file extension:
> '.xz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> attachment vir.7z found for Level-1*
> *May-03-16 13:47:39 m1-76058-25618 [Worker_1] [TLS-in] [TLS-out]
> [Attachment] 212.227.17.22 <sen...@remote.tld> to: r...@local.tld info:
> using user based compressed attachment check*
>
> but the message:
> *replaced bad attachment '53ddc8.js.lrz' is a ' - the file extension:
> '.lrz' does not match the content based detected file type ''' with
> '53ddc8.js.txt'*
> is barely understandable..... makes no sense...
>
> 2) tar.gz is detected as archive but assp stops processing the archive...
> no further action is taken after this message and the tar.gz attachment
> goes to the inbox, untouched:
>
> *May-03-16 13:47:40 [Worker_1] Info: will detect executables in compressed
> files*
> *May-03-16 13:47:40 [Worker_1] Info: analyzing compressed file
> /opt/assp/tmp/zip_1_1462276060/vir.tar.gz at zip-level 0*
> *May-03-16 13:47:40 [Worker_1] Info: looking for filetype in: .gz .emz*
> *May-03-16 13:47:40 [Worker_1] Info: found compressed file with type: 'gz'*
>
> On Tue, May 3, 2016 at 1:32 PM, Thomas Eckardt <thomas.ecka...@thockar.com
> > wrote:
>
>> 7z - was my mistake - forgot it the regex
>>
>> File::Type does not know several formats - I'll have to fix them one by
>> one - the lz.... formats should be fixed
>>
>> please download the plugin again - the version is not changed
>>
>> Thomas
>>
>>
>>
>>
>>
>> Von: aquilinux <aquili...@gmail.com>
>> An: ASSP development mailing list <assp-test@lists.sourceforge.net>
>> Datum: 03.05.2016 12:43
>> Betreff: Re: [Assp-test] [request] AFC and rar archives
>>
>>
>>
>> actually, i tested rar since it's the only archive been used besides zip.
>>
>> I did tests with 7z, lrz and lzma but the file is not detected as a zip:
>>
>> *May-03-16 12:28:50 [Worker_2] Info: will detect executables in compressed
>> files*
>> *May-03-16 12:28:50 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462271330/vir.7z at zip-level 0*
>> *May-03-16 12:28:50 [Worker_2] Info: looking for filetype in: .7z*
>> *May-03-16 12:28:50 [Worker_2] Info: /opt/assp/tmp/zip_2_1462271330/vir.7z
>> seems not to be a compressed file*
>>
>> *May-03-16 12:28:50 [Worker_2] Info: will detect executables in compressed
>> files*
>> *May-03-16 12:28:50 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462271330/53ddc8.js.lrz at zip-level 0*
>> *May-03-16 12:28:50 [Worker_2] Info: looking for filetype in: .lrf .mar
>> .dist .distz .bpk .dump .deploy .lhx .saveme .buffer*
>> *May-03-16 12:28:50 [Worker_2] Info:
>> /opt/assp/tmp/zip_2_1462271330/53ddc8.js.lrz seems not to be a compressed
>> file*
>>
>> *May-03-16 12:40:35 [Worker_2] Info: analyzing compressed file
>> /opt/assp/tmp/zip_2_1462272035/vir.lzma at zip-level 0*
>> *May-03-16 12:40:35 [Worker_2] Info:
>> /opt/assp/tmp/zip_2_1462272035/vir.lzma seems not to be a compressed file*
>>
>>
>> On Tue, May 3, 2016 at 12:03 PM, Thomas Eckardt
>> <thomas.ecka...@thockar.com>
>> wrote:
>>
>> > >It works as expected.
>> >
>> > What have you tested?
>> >
>> > which executable?
>> > which compression formats?
>> >
>> > Thomas
>> >
>> >
>> >
>> >
>> >
>> > Von: aquilinux <aquili...@gmail.com>
>> > An: ASSP development mailing list <assp-test@lists.sourceforge.net>
>> > Datum: 03.05.2016 12:01
>> > Betreff: Re: [Assp-test] [request] AFC and rar archives
>> >
>> >
>> >
>> > It works as expected.
>> > Thanks.
>> >
>> > On Tue, May 3, 2016 at 11:53 AM, aquilinux <aquili...@gmail.com> wrote:
>> >
>> > > Hi Thomas, thanks for the release.
>> > > I'm testing it right now.
>> > >
>> > > On Tue, May 3, 2016 at 10:37 AM, Thomas Eckardt <
>> > > thomas.ecka...@thockar.com> wrote:
>> > >
>> > >> You may try ASSP_AFC.pm 4.27.
>> > >>
>> > >>
>> >
>> >
>>
>> http://assp.cvs.sourceforge.net/viewvc/assp/assp2/Plugins/ASSP_AFC_V4_SMIME/
>>
>> >
>> > >>
>> > >> To support additionally decompression formats, you have to install
>> > >> Archive::Rar
>> > >> To support RAR decopression you need to install a rar or unrar
>> > executable
>> > >> in the PATH.
>> > >> To support various other decompression formats you need to install a
>> > >> 7z,7za,7zip or p7zip executable in the PATH.
>> > >> For windows the required executables are included in the ppm
>> installer
>> > for
>> > >> Archive::Rar at the ASSP2 repo.
>> > >>
>> > >> Thomas
>> > >>
>> > >>
>> > >>
>> > >>
>> > >>
>> > >> Von: aquilinux <aquili...@gmail.com>
>> > >> An: ASSP development mailing list
>> <assp-test@lists.sourceforge.net>
>> > >> Datum: 28.04.2016 12:07
>> > >> Betreff: [Assp-test] [request] AFC and rar archives
>> > >>
>> > >>
>> > >>
>> > >> Hi Thomas, any chance in having assp processing rar archives?
>> > >>
>> > >> regards,
>> > >> aqx
>> > >>
>> > >> --
>> > >> "Madness, like small fish, runs in hosts, in vast numbers of
>> > instances."
>> > >>
>> > >> Nessuno mi pettina bene come il vento.
>> > >>
>> > >>
>> >
>> >
>>
>> ------------------------------------------------------------------------------
>> > >> Find and fix application performance issues faster with Applications
>> > >> Manager
>> > >> Applications Manager provides deep performance insights into multiple
>> > >> tiers of
>> > >> your business applications. It resolves application problems quickly
>> > and
>> > >> reduces your MTTR. Get your free trial!
>> > >> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > >> _______________________________________________
>> > >> Assp-test mailing list
>> > >> Assp-test@lists.sourceforge.net
>> > >> https://lists.sourceforge.net/lists/listinfo/assp-test
>> > >>
>> > >>
>> > >>
>> > >>
>> > >> DISCLAIMER:
>> > >> *******************************************************
>> > >> This email and any files transmitted with it may be confidential,
>> > legally
>> > >> privileged and protected in law and are intended solely for the use
>> of
>> > the
>> > >>
>> > >> individual to whom it is addressed.
>> > >> This email was multiple times scanned for viruses. There should be no
>> > >> known virus in this email!
>> > >> *******************************************************
>> > >>
>> > >>
>> > >>
>> > >>
>> >
>> >
>>
>> ------------------------------------------------------------------------------
>> > >> Find and fix application performance issues faster with Applications
>> > >> Manager
>> > >> Applications Manager provides deep performance insights into multiple
>> > >> tiers of
>> > >> your business applications. It resolves application problems quickly
>> > and
>> > >> reduces your MTTR. Get your free trial!
>> > >> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > >> _______________________________________________
>> > >> Assp-test mailing list
>> > >> Assp-test@lists.sourceforge.net
>> > >> https://lists.sourceforge.net/lists/listinfo/assp-test
>> > >>
>> > >>
>> > >
>> > >
>> > > --
>> > > "Madness, like small fish, runs in hosts, in vast numbers of
>> instances."
>> > >
>> > > Nessuno mi pettina bene come il vento.
>> > >
>> >
>> >
>> >
>> > --
>> > "Madness, like small fish, runs in hosts, in vast numbers of instances."
>> >
>> > Nessuno mi pettina bene come il vento.
>> >
>> >
>>
>> ------------------------------------------------------------------------------
>> > Find and fix application performance issues faster with Applications
>> > Manager
>> > Applications Manager provides deep performance insights into multiple
>> > tiers of
>> > your business applications. It resolves application problems quickly and
>> > reduces your MTTR. Get your free trial!
>> > https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > _______________________________________________
>> > Assp-test mailing list
>> > Assp-test@lists.sourceforge.net
>> > https://lists.sourceforge.net/lists/listinfo/assp-test
>> >
>> >
>> >
>> >
>> > DISCLAIMER:
>> > *******************************************************
>> > This email and any files transmitted with it may be confidential,
>> legally
>> > privileged and protected in law and are intended solely for the use of
>> the
>> >
>> > individual to whom it is addressed.
>> > This email was multiple times scanned for viruses. There should be no
>> > known virus in this email!
>> > *******************************************************
>> >
>> >
>> >
>> >
>>
>> ------------------------------------------------------------------------------
>> > Find and fix application performance issues faster with Applications
>> > Manager
>> > Applications Manager provides deep performance insights into multiple
>> > tiers of
>> > your business applications. It resolves application problems quickly and
>> > reduces your MTTR. Get your free trial!
>> > https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> > _______________________________________________
>> > Assp-test mailing list
>> > Assp-test@lists.sourceforge.net
>> > https://lists.sourceforge.net/lists/listinfo/assp-test
>> >
>> >
>>
>>
>> --
>> "Madness, like small fish, runs in hosts, in vast numbers of instances."
>>
>> Nessuno mi pettina bene come il vento.
>>
>> ------------------------------------------------------------------------------
>> Find and fix application performance issues faster with Applications
>> Manager
>> Applications Manager provides deep performance insights into multiple
>> tiers of
>> your business applications. It resolves application problems quickly and
>> reduces your MTTR. Get your free trial!
>> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>>
>>
>> DISCLAIMER:
>> *******************************************************
>> This email and any files transmitted with it may be confidential, legally
>> privileged and protected in law and are intended solely for the use of the
>>
>> individual to whom it is addressed.
>> This email was multiple times scanned for viruses. There should be no
>> known virus in this email!
>> *******************************************************
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Find and fix application performance issues faster with Applications
>> Manager
>> Applications Manager provides deep performance insights into multiple
>> tiers of
>> your business applications. It resolves application problems quickly and
>> reduces your MTTR. Get your free trial!
>> https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
>> _______________________________________________
>> Assp-test mailing list
>> Assp-test@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/assp-test
>>
>>
>
>
> --
> "Madness, like small fish, runs in hosts, in vast numbers of instances."
>
> Nessuno mi pettina bene come il vento.
>
--
"Madness, like small fish, runs in hosts, in vast numbers of instances."
Nessuno mi pettina bene come il vento.
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
