Re: exiscan not finding some W32/MyDoom-O viruses

> 
> I use Sophos AV along with Exim/exiscan to check for incoming viruses.
> 
> I've found that some W32/MyDoom-O are not being picked up by exiscan.
> In one particular case the virus is in an attachment called tofn.zip
> with an infected .scr file. If I save the attachment and scan it
> manually Sophos detects the virus ok. Also, if I attach this zip
> archive to a new message and attempt to send it Exim/exiscan correctly
> identifies it and refuses to deliver the message.
> 
> The only thing I can find during testing is the log messages:
> 
> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length exceeds
> 76 characters LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line
> contains illegal character LOG: 1CH11u-0005f7-A8 demime acl condition:
> base64 line length is not a multiple of 4 characters
> 
> Will this prevent exiscan from extracting the attachment for scanning?
> This test was run on a RedHat FC1 system with the exim-4.41-0_24.fc1
> RPM installed.
> 
> It certainly doesn't prevent a mail client from saving the attachment
> or unzip from unpacking it, which means the infected attachment is
> still dangerous.
> 


I saw the very same effect and solved it by changing the condition 
line of

deny    message      = MIME defect detected ($demime_reason)
        demime       = *
        condition    = ${if >{$demime_errorlevel}{2}{1}{0}}

to
        condition    = ${if >{$demime_errorlevel}{0}{1}{0}}

i.e. I'm now catching all MIME defects instead of serious ones only.


---
Peter Rindfuss
Wissenschaftszentrum Berlin fuer Sozialforschung
(Social Science Research Center Berlin, Germany)
email: [email protected]
phone: +49-30-25491-566  fax: +49-30-25491-558