> You haven't provided enough information to determine whether you are just
> as confused as everyone else, or whether you know what you are doing and
> have determined something very useful to know.
Confused yes, scared yes, pissed off at this whole situation YES. What I
have determined is that Trend is actively blocking these encrypted zip
files. And by checking the logs, I see that none are getting through right
now.
> Specifically, YOUR (and everyone else's) mailserver AV program will detect
> "static" viruses in encrypted .ZIP files.
This may be what is happening. I don't know how they are doing it.
> They will also all detect any
> encrypted viruses after they have been decrypted manually. They will also
Since this is our mail gateway this is not a possability unless someone
forwards an unencrypted virus file to us.
> all detect viruses such as Bagle.J that appear in both non-encrypted files
> and in encrypted files, but will *only* detect them in the non-encrypted
files.
Are you saying the zip files have more than one file in them, and that one
is encrypted and the other is not and that is how Trend is catching it? I
don't know because I have not opened any of these zip files. I'm not that
curious.
> If you proof of a mailserver AV program catching a non-static virus (such
> as Bagle.J) in an encrypted .ZIP file, this would be news indeed.
However,
> you would need to check the CRCs of the files within the .ZIP files to
make
> sure that they are not the same.
We have received a number of these and I have a password protected zip file
infected with the bagle.J virus. The readme zip and the textfile zip. Is
this not what you are refering to? Would you like a copy of one to analyze?
We are still receiving these and now some identified as
bagle.GEN-1. I can't get to the files as Interscan is killing them off and
we don't save the virus files:
I don't bite, weah!
pass: 67158
----------xwldumfvrvahryrdmcor
Content-Type: text/plain;
name="InterScan_SafeStamp.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="InterScan_SafeStamp.txt"
****** Message from InterScan E-Mail VirusWall NT ******
** WARNING! Attached file Text.zip contains:
WORM_BAGLE.GEN-1 virus
Argh, i don't like the plaintext :)
pass: 67158
----------nvwgbaekkrddcttisogd
Content-Type: text/plain;
name="InterScan_SafeStamp.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="InterScan_SafeStamp.txt"
****** Message from InterScan E-Mail VirusWall NT ******
** WARNING! Attached file AttachedDocument.zip contains:
WORM_BAGLE.GEN-1 virus
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
