Re: Multiple malware scanners

On Wed, 18 Aug 2004, Steven Dickenson wrote:

|
| Slightly on topic, does anyone know how to reject password protected ZIPs?
|

We do that in the DATA ACL with a recipe matching the initial byte
sequence of an passwd-protected zip:

  deny	condition = ${if match{$message_body:}{  UEsDB....[Q-Za-fw-z0-9\+/]}{yes}{no}}

Note the *TWO* spaces before the "UEs" are needed to match:

(1) the preceeding blank line and
(2) the new line

Need to set $message_body_visible to something decent.  We use 50 KB.

For the derivation of this, see:

  http://www.gla.ac.uk/~chris/recipes/zip-sig.html

-- 
Chris Edwards, Glasgow University Computing Service.