[ILUG] Amavis

[Dermot Daly]

The latest Bagle viruses include zip files which are password protected
- The mail body includes the password so that uninformed users will use
this to open the zip, and thus propagate the virus.

Anti-Virus products cannot open the zip due to the fact that it is
password protected (this is the reason behind the password protection).

Might be worth telling your users to not open any zip files that require
a password - Most likely this will be bagle.

Cheers,
Dermot.

-----Original Message-----
From: Peter McEvoy [mailto:pete at yerma.org] 
Sent: 04 March 2004 10:54
To: ilug at linux.ie
Subject: Re: [ILUG] Amavis


On Thu, Mar 04, 2004 at 10:48:13AM +0000, Kevin Philp wrote:
> Just noticed with the blitz of Bagle worms coming into our mail server

> that
> Amavis is not unpacking zip files, it happily unpacks just about every
other 
> type of archive. Looking in the config file there is no link between
zip type 
> files and unzip or zip aas there is for the other archive packages. I
have 
> tried adding the link but it throws an error. We have the CPAN module 
> Archive::Zip installed. any tips on what I am doing wrong?

Im having similar problems, except with exiscan and exim. You can find
more info here:

http://www.mail-archive.com/clamav-users%40lists.sourceforge.net/msg0627
0.html

There is more discussion on the subject in the clamav-user archives, and
I would guess the amavis archives too.

--
Pete
-- 
Irish Linux Users' Group http://www.linux.ie/mailman/listinfo/ilug/