Re: encrypted zips / sophie

David Rueter wrote:

>Are you trying to scan the native files in the maildirs?
>
>In my experience, SAV can't do this (it doesn't know how to scan
>MIME-encoded files).
>
>  
>
Yes. That's what I was doing.

>I wrote a script that uses Sophie/SAV to accomplish this task, however:  it
>recurses the specified path, and for each file it munpacks to a temporary
>directory, scans the resulting files with SAV via Sophie (and here the virus
>IS detected once the files are munpacked).  If a virus is found, it moves
>the original infected file to a specified quarantine folder.  It then cleans
>up the temporary directory.
>
>I would be happy to send you the script if this is what you are trying to
>do.
>
>  
>
That would be great. Thanks David!

 - jim -

PS We wrote a search-and-destroy script and ran it on our mail servers. 
It found and
      deleted over 2 gigs worth of infected mail messages, all 
containing the bagle-h worm.