<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div><div style="font-family: Calibri,sans-serif; font-size: 11pt;">Hi,<br><br>Can you provide a link with this file?<br>I would like to debug and come with a solution.<br><br>Thanks,<br>Marius<br><br>Sent from phone</div></div><div dir="ltr"><hr><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:selsky@gmail.com">Matt Selsky</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">9/3/2015 1:46 PM</span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:amavis-users@amavis.org">amavis-users@amavis.org</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Block/Detect mangled zip files</span><br><br></div><div dir="ltr"><div>I'm running amavisd-new 1:2.7.1-2 on Debian wheezy.</div><div><br></div>I'm receiving zip files that are mangled. unzip isn't able to read the file:<div><br></div><div><div><div>$ unzip -l /tmp/malware.zip</div><div>Archive: /tmp/malware.zip</div><div> End-of-central-directory signature not found. Either this file is not</div><div> a zipfile, or it constitutes one disk of a multi-part archive. In the</div><div> latter case the central directory and zipfile comment will be found on</div><div> the last disk(s) of this archive.</div><div>unzip: cannot find zipfile directory in one of /tmp/malware.zip or</div><div> /tmp/malware.zip.zip, and cannot find /tmp/malware.zip.ZIP, period.</div></div></div><div><br></div><div>clamav is able to open the zip file, but doesn't detect the virus:<br></div><div><br></div><div><div>$ clamscan -a -v /tmp/malware.zip</div><div>Scanning /tmp/malware.zip</div><div>Scanning /tmp/malware.zip!ZIP:jeffry_boyersunt.quia.exe</div><div>/tmp/malware.zip: OK</div><div><br></div><div>----------- SCAN SUMMARY -----------</div><div>Known viruses: 5963596</div><div>Engine version: 0.98.7</div><div>Scanned directories: 0</div><div>Scanned files: 1</div><div>Infected files: 0</div><div>Data scanned: 0.01 MB</div><div>Data read: 0.01 MB (ratio 1.00:1)</div><div>Time: 8.012 sec (0 m 8 s)</div></div><div><br></div><div><br></div><div>My site's policy is to block all .exe extensions, including within zip files, but zip files are generally allowed if they only contain allowed extensions.</div><div><br></div><div>I switched over to 7zip (9.38.1 built from source) and now amavis reports (debugging enabled):</div><div><div>2015-09-03T03:40:14.680+00:00 <a href="http://example.com">example.com</a> amavis[4654]: (04654-02) do_7zip: member: "/var/lib/amavis/tmp/amavis-20150903T033951-04654-lnscgKNE/parts/p002", bytes</div><div>2015-09-03T03:40:14.680+00:00 <a href="http://example.com">example.com</a> amavis[4654]: (04654-02) do_7zip: member: "jeffry_boyersunt.quia.exe", 45568 bytes</div><div>2015-09-03T03:40:14.682+00:00 <a href="http://example.com">example.com</a> amavis[4654]: (04654-02) (!)Decoding of p002 (Zip archive data, at least v2.0 to extract) failed, leaving it unpacked: do_7zip: can't get a list of archive members: exit 2; Errors: 1</div></div><div><br></div><div>Do the parsed members of the zip file get thrown away from the zip error is encountered? Does it make sense to ignore the errors in order to block these mangled zip files?</div><div><br></div><div>Cheers,</div><div>-Matt</div></div>
</body></html>