Re: missing viruses

On Wed, May 12, 2004 at 09:21:43AM +0200, Sascha Lucas wrote:
> > Are you running amavisd-new too? You need the very latest  version  to
> > catch malware in encrypted zips. Older versions will just skip them in
> > "most" cases (not all - not sure why).
> 
> that is not true. I'm running amavisd-new-20030616-p7. And I have 
> configured $bypass_decode_parts = 1;. So unpacking is handeld by Sophie 
> and NAI uvscan.

With that configuration, agreed. But I don't trust Sophos to  do  MIME
unpacking so I leave this job to amavisd-new.

> Even if you have $bypass_decode_parts = 0; amavis should 
> pass encrypted zips to the AVs.

Depends on which "old" version we are talking about here. I'm  talking
about an older version: amavisd-new-20021227-p1 which was the  version
we  were  still  using  when  Bagle-F came out. I haven't investigated
fully why, but I had to apply the following patch to this version  for
Bagle-F to be reliably detected:

*** amavisd.bak-alainf-20040317 Wed Mar 17 11:02:42 2004
--- amavisd     Wed Mar 17 11:04:10 2004
***************
*** 3196,3202 ****
        do_log(5, "file type is $filetype, retain original $part");
        $sts = 2;
      }
!     if ($sts == 1) {
        unlink($filename) or die "Can't unlink $filename: $!";
      }
      do_log(4, "decompose_part: $part - " .
--- 3196,3206 ----
        do_log(5, "file type is $filetype, retain original $part");
        $sts = 2;
      }
! # 12-Mar-2004 AlainF    Temporary work-around for Bagle-F & al.
! #                       Do not delete the part if it's a zip
! #                       and unzipping it has failed (encrypted)
! #    if ($sts == 1) {
!     if ($sts == 1 && $ty !~ /^\.zip$/) {
        unlink($filename) or die "Can't unlink $filename: $!";
      }
      do_log(4, "decompose_part: $part - " .

I've updated amavisd-new since then, and the newer versions do this already.

> So it is the AVs job...

Well, when Bagle-F came out, it certainly  took  a  certain  time  for
Sophos to scan encrypted zip  archives  as  I've  noticed  and  people
confirmed  in  various  places. Actually that's what decided me to add
Trend to our mail gateway.

Mind you - I like Sophos. They do a great job usually and they're very
responsive.  But  that  time,  they've hold on a bit too long to their
policy of not scanning encrypted zips at all.

> True is, that the latest amavisd-new has an option to stop encrypted 
> archives, wich is normaly not a good option, because password protectet 
> archives are often used (not only by viruses :-)).

Agreed that's not a good idea. But password-protected zips should be un-MIMEd
and passed to the a/v, just as recent versions of amavisd-new do.

Greets,
_Alain_