exiscan not finding some W32/MyDoom-O viruses
Nigel Wade <[email protected]> Mon, 11 Oct 2004 15:48:38 +0100
| Newsgroups | gmane.mail.exim.exiscan.user |
|---|---|
| Message-ID | <[email protected]> |
I use Sophos AV along with Exim/exiscan to check for incoming viruses.
I've found that some W32/MyDoom-O are not being picked up by exiscan. In one
particular case the virus is in an attachment called tofn.zip with an
infected .scr file. If I save the attachment and scan it manually Sophos
detects the virus ok. Also, if I attach this zip archive to a new message
and attempt to send it Exim/exiscan correctly identifies it and refuses to
deliver the message.
The only thing I can find during testing is the log messages:
LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length exceeds 76
characters
LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line contains illegal
character
LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length is not a
multiple of 4 characters
Will this prevent exiscan from extracting the attachment for scanning?
This test was run on a RedHat FC1 system with the exim-4.41-0_24.fc1 RPM
installed.
It certainly doesn't prevent a mail client from saving the attachment or
unzip from unpacking it, which means the infected attachment is still dangerous.
--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : [email protected]
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555