Re: exiscan not finding some W32/MyDoom-O viruses

Nigel Wade wrote:

> The only thing I can find during testing is the log messages:
> 
> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length exceeds 
> 76 characters
> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line contains illegal 
> character
> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length is not a 
> multiple of 4 characters
> 
> Will this prevent exiscan from extracting the attachment for scanning?

Probably. The demime implementation is "best-effort", and may not always 
get a file right when the encoding is incorrect.

However the Sophos scanner should not depend on exiscans MIME 
implementation, it should use its own engine (on the provided raw .eml 
file).

You can also reject messages with such MIME errors, unfortunately you 
may end up with some collateral damage since there are some poorly 
written MIME encoders around which have the same flaws (particularly in 
Webmail software which uses Perl/PHP modules).

regards,

/tom