Re: missing viruses

> Are you running amavisd-new too? You need the very latest  version  to
> catch malware in encrypted zips. Older versions will just skip them in
> "most" cases (not all - not sure why).

that is not true. I'm running amavisd-new-20030616-p7. And I have 
configured $bypass_decode_parts = 1;. So unpacking is handeld by Sophie 
and NAI uvscan. Even if you have $bypass_decode_parts = 0; amavis should 
pass encrypted zips to the AVs. So it is the AVs job...
True is, that the latest amavisd-new has an option to stop encrypted 
archives, wich is normaly not a good option, because password protectet 
archives are often used (not only by viruses :-)).

BTW: My experience with pattern updates are that sophos reacts fast. 
As fast as NAI. But its true where Bagle-Zip appears, NAI has patterns and 
sophos needs some days. The reason seams to me, NAI has before this 
patterns to detect .zip without unpacking (i.e. 42.zip) sophos not. In 
this time on the amavis-ml you can read that also calmav (clamd) can 
detect Bagle-Zip early.

Greetings Sascha.