Can't Block .js files inside of .zip Email Attachments

[Kirchner, Patrick]

Thanks for the replyMaurizio,

While watching my log files in real time just this morning (with multitail), I saw it actually catch a zipped .js file and quarantine it.  I guess my setup is actually working after a.  I'm just not sure why it wasn't catching the zipped .js files I was using when trying to test it.

Here's what the successful catch and quarantine looked like in my log files:

May 10 10:58:34 MyDomain postfix/smtpd[13926]: disconnect from localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
May 10 10:58:34 MyDomain amavis[22701]: (22701-05) Blocked BANNED (.txt,00000306822303.js) {DiscardedInbound,Quarantined}, [1.39.38.104]:25610 [1.39.38.104] <purchase at kalyanimotors.com> ->
<user1 at MyDomain.com>, quarantine: banned-wxHJRbncZSpE, Queue-ID: 1327823BA4F6, Message-ID: <CAPXewJUV4+S3goOpP7HyrTPM7k6s0DAjWSCCdu=XopjGqqQYHw at mail.gmail.com>, mail_id: wxHJRbncZSpE, Hits: -, size: 8712, 1418 ms
May 10 10:58:34 MyDomain postfix/lmtp[13919]: 1327823BA4F6: to=<user1 at MyDomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3, delays=1.6/0.01/0.13/1.4, dsn=2.7.0, status=sent (250 2.7.0 Ok, discarded, id=22701-05 - BANNED: .txt,00000306822303.js)
May 10 10:58:34 MyDomain postfix/qmgr[3980]: 1327823BA4F6: removed

Thanks,
Patrick.


-----Original Message-----
From: Maurizio Marini [mailto:maumar at datalogica.com] 
Sent: Tuesday, May 10, 2016 1:04 PM
To: Kirchner, Patrick <KirchnerPA at lakeland.edu>
Cc: amavis-users at amavis.org
Subject: Re: Can't Block .js files inside of .zip Email Attachments

On Fri, 6 May 2016 15:24:10 +0000
"Kirchner, Patrick" <KirchnerPA at lakeland.edu> wrote:

> An infected .js file in a .zip file that made its way through the email
> server was luckily blocked by antivirus on my wife's Mac, so I'd really like
> to be able to block such files.  I can provide an sample of one of the .js
> files if it would be helpful.

Hello Patrick
I had the same issue, you have to raise log level, then you can check if zip
file is unzipped; js are blocked, but ziped files should be opened
 I solved by installing p7zip
this is not enough, you should configure amavis to use it whan you receive zip
attachments
I used this

unshift(@decoders,
  ['zip',  \&Amavis::Unpackers::do_7zip, ['7z','7za'] ],
);

I am not  an expert at all, I am very lame and I can't say this is the
proper solution, what I note was that after this configuration zipped
attachments were correctly opened

-m