<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Il 12/04/2016 16:34, Thomas Jarosch ha
scritto:<br>
</div>
<blockquote cite="mid:2948122.9j2Zba6AZf@storm" type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">On Monday, 11. April 2016 18:08:19 Alessandro Briosi wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">> </span>The odd thing is that it still passes if I enable the following (The
<span class="moz-txt-citetags">> </span>#don't trust Archive::Zip part), which was commented before.
<span class="moz-txt-citetags">> </span>
<span class="moz-txt-citetags">> </span>@keep_decoded_original_maps = (new_RE(
<span class="moz-txt-citetags">> </span># qr'^MAIL$', # retain full original message for virus checking (can
<span class="moz-txt-citetags">> </span>be slow)
<span class="moz-txt-citetags">> </span> qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains
<span class="moz-txt-citetags">> </span>undecipherables
<span class="moz-txt-citetags">> </span> qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
<span class="moz-txt-citetags">> </span> qr'^Zip archive data', # don't trust Archive::Zip
<span class="moz-txt-citetags">> </span>));
<span class="moz-txt-citetags">> </span>
<span class="moz-txt-citetags">> </span>And on the server using unzip works correctly.
</pre>
</blockquote>
<pre wrap="">@keep_decoded_original_maps just keeps the .zip file around.
Since you don't block .zip files, it's more or less by design it passes.
Or do you mean "it passes the virus scanner"?
That's a matter of how fast the AV vendor gets
the sample and adds (generic) detection for it.
Thomas
</pre>
</div>
</blockquote>
<br>
Ho, ok,<br>
<br>
I thought the "# don't trust Archive::Zip" meant to use "unzip" and
not the perl library to handle zip files.<br>
<br>
It passes the virus scanner, but that's because this kind of virus
(probably cryptolocker, don't get caught by most antivirus software)<br>
<div class="moz-signature"><br>
Alessandro<br>
</div>
</body>
</html>