Re: encrypted zips / sophie
Yevgeniy Miretskiy <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
On [03/03/04 12:43], Chris Edwards wrote: > Hi, > > If anyone's interested, its easy to make sophie block encrypted zips. > > In sophie_core.c find the "case SOPHOS_SAVI_ERROR_FILE_ENCRYPTED:" and set > the return value to 1. > > .... With the latest greatest Bagel-K virus out there, what do people think is the right way to address this issue? I don't know if anybody uses password protected zip files, but I guess some people do. BLocking all of password protected zips might be a bit harsh... On the other hand, it really escapes me why sophos does not develope a more specific sig: you know the file name of the encrypted file, you know the size... -- Eugene Miretskiy <[email protected]> INVISION.COM, INC. (631) 543-1000 www.invision.net / www.longisland.com _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools
signature.asc
(application/pgp-signature, 187 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iD4DBQFARfpbbdWhgMNo07URAjS1AJjmb4CAl1Pv/x1TWs6LJU4TyJbXAJ4t7y9/ lNJP/q8fjcnpjNXl4iNchQ== =GjNO -----END PGP SIGNATURE-----