Re: exiscan not finding some W32/MyDoom-O viruses

Tom Kistner wrote:
> Nigel Wade wrote:
> 
>> The only thing I can find during testing is the log messages:
>>
>> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length exceeds 
>> 76 characters
>> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line contains 
>> illegal character
>> LOG: 1CH11u-0005f7-A8 demime acl condition: base64 line length is not 
>> a multiple of 4 characters
>>
>> Will this prevent exiscan from extracting the attachment for scanning?
> 
> 
> Probably. The demime implementation is "best-effort", and may not always 
> get a file right when the encoding is incorrect.
> 
> However the Sophos scanner should not depend on exiscans MIME 
> implementation, it should use its own engine (on the provided raw .eml 
> file).

Unfortunately this is one which gets past Sophos. It's a "hidden" .scr file 
in a zip inside another zip, and Sophos doesn't find it in the raw email. If 
I detach the zip attachment then it finds it.

> 
> You can also reject messages with such MIME errors, unfortunately you 
> may end up with some collateral damage since there are some poorly 
> written MIME encoders around which have the same flaws (particularly in 
> Webmail software which uses Perl/PHP modules).

Yes, I'd thought about that option. I think it would probably annoy more 
users than the occasional infected email (all Windows clients have Symantec 
NAV on them, which finds this particular variant).

I may try rejecting level 1 errors and monitor the logs closely to see what 
gets rejected. Is there a list of what level each MIME error is?

> 
> regards,
> 
> /tom

Thanks.

-- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    [email protected]
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555