I am receiving a lot of emails with .zip attachments:
If it try "unzip -t email-doc.zip" I get:
Archive: email-doc.zip
error [email-doc.zip]: missing 78848 bytes in zipfile
(attempting to process anyway)
error [email-doc.zip]: attempt to seek before beginning of zipfile
(please check that you have transferred or created the zipfile in the
appropriate BINARY mode and that you have compiled UnZip properly)
(attempting to re-compensate)
testing: letter.info.exe bad CRC 56d2a102 (should be
22a8a6fd)
At least one error was detected in email-doc.zip.
So, according to unzip, the file is corrupt, so it can therefore not be
scanned. Is there a setting in clamav that I can cause it to reject
emails if the .zip file is corrupt in some way?
I am fairly sure this is a virus of some type. Maybe it exploits a bug
in some windows unzipper. In any case, I wish to drop it like I do for
all other virus emails.
Any clues on how I could do this?
James
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
