better demime handling?
"Fajar A. Nugraha" <[email protected]> Mon, 01 Nov 2004 12:43:01 +0700
| Newsgroups | gmane.mail.exim.exiscan.user |
|---|---|
| Message-ID | <[email protected]> |
Hi, I'm using exiscan-acl-4.14-24 (It's not the latest version, I know). Changelog http://duncanthrax.net/exiscan-acl/CHANGELOG shows no change in demime handling from 24-28. I have been using exiscan's demime to unpack mail attachments and have clamav scan it. Some MyDoom.M viruses were correctly identified from the unpacked attachments. Others, however, cause exiscan to create broken attachment (broken .zip, to be exact), which cannot be unpacked with unzip, and clamav couldn't detect anything on it. If I run clamscan (with its own mail scanning engine enabled) on the original mail (not the attachment), it can recognize the .zip attachment, can recognize the file in it (.scr), and can find the virus MyDoom.M So, obviously, clamav's engine (it's not using demime, btw) can unpack this particular mail correctly but exiscan cannot (it only creates broken attachment). Is there a plan to improve exiscan's demime unpacker? I have the mail sample if anyone's interested. Regards, Fajar