exiscan not finding some W32/MyDoom-O viruses

Nigel Wade <[email protected]> Mon, 11 Oct 2004 15:48:38 +0100
Newsgroups gmane.mail.exim.exiscan.user
Message-ID <[email protected]>
I use Sophos AV along with Exim/exiscan to check for incoming viruses.

I've found that some W32/MyDoom-O are not being picked up by exiscan. In one 
particular case the virus is in an attachment called tofn.zip with an 
infected .scr file. If I save the attachment and scan it manually Sophos 
detects the virus ok. Also, if I attach this zip archive to a new message 
and attempt to send it Exim/exiscan correctly identifies it and refuses to 
deliver the message.

The only thing I can find during testing is the log messages:

LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length exceeds 76 
characters
LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line contains illegal 
character
LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length is not a 
multiple of 4 characters

Will this prevent exiscan from extracting the attachment for scanning?
This test was run on a RedHat FC1 system with the exim-4.41-0_24.fc1 RPM 
installed.

It certainly doesn't prevent a mail client from saving the attachment or 
unzip from unpacking it, which means the infected attachment is still dangerous.

-- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    [email protected]
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555