" The reason it is getting through is a combination of [1] the mailserver AV program can't detect the virus (it is impossible in many cases)"
We said the same thing in a different way. The reason the AV software can't detect the virus because it is unable to open the zip because it is password protected.
Actually, it gets even more complicated (I warned about that <G>).
All AV programs should be able to detect viruses in plain (unencrypted) .ZIP files.
For encrypted .ZIP files, though, there are several variations:
[1] A static encrypted .ZIP file. This one will always have the same file (although probably different passwords). Since the file is exactly the same, an AV program *can* detect the file based on the CRC and file length, and perhaps filename as well. This can be a bit risky, as it can have rare false positives.
[2] A dynamic encrypted .ZIP file with the password in the text of the E-mail. With this, the attachment changes sizes and CRCs. This one can only be detected by mailserver AV software *if* the body of the E-mail is parsed, and it is known where the password is. Some mailserver AV programs do this; most do not. However, because one did it, the next virus:
[3] A dynamic encrypted .ZIP file with a password hidden in the E-mail (in a picture, or through AI such as "The password is the number 48300 plus the number of sides on a triangle"). No known mailserver AV program can detect these.
However, what this all says is that you MUST block encrypted .ZIP files. It isn't an option anymore. If you do not block them, you will let viruses through. If you use a mailserver AV program that doesn't let you do this, you really need to switch to one that does (after all, what is the point of AV software that allows viruses through?).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
