Re: missing viruses

Sascha Lucas <[email protected]> Wed, 12 May 2004 13:01:17 +0200 (CEST)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Wed, 12 May 2004, Alain Fauconnet wrote:

> With that configuration, agreed. But I don't trust Sophos to  do  MIME
> unpacking so I leave this job to amavisd-new.

thats ok. there were problems with mime-decoding. but $bypass_decode_parts 
= 1; does not mean to skip decoding mime. mime decoding is done by 
amavisd-new. archive unpacking by the AVs.

> Depends on which "old" version we are talking about here. I'm  talking
> about an older version: amavisd-new-20021227-p1 which was the  version

This is before I started to learn postfix, amavis, sophie, ... :-)

> Well, when Bagle-F came out, it certainly  took  a  certain  time  for
> Sophos to scan encrypted zip  archives  as  I've  noticed  and  people
> confirmed  in  various  places. Actually that's what decided me to add
> Trend to our mail gateway.

Sorry I can not see this in my setup. Sophie behaves the same 
way with or without encrypted zips.

> Agreed that's not a good idea. But password-protected zips should be un-MIMEd
> and passed to the a/v, just as recent versions of amavisd-new do.

see above...

Greetings Sascha.