Michael,
> %admin_maps_by_ccat = (
> CC_UNCHECKED, sub { ca('virus_admin_maps') },
> what would trigger that?
> why would it be unchecked? what would make it unchecked?
> and don't I want to know if an email us unchecked?
A content is considered unchecked when some part is either:
- encrypted/scrambled/password protected
- an archive cannot be decoded, e.g when it is damaged
- further decoding is cancled because file or recursion
sanity limits are exceeded
- all virus scanners failed (this one is new with 2.7.0)
Eray Aslan wrote:
> Email submission with a regular excel xlsx file attached:
>
> (29093-06) p003 1/2 Content-Type: application/vnd.openxmlformats-
> officedocument.spreadsheetml.sheet, size: 1186624 B, name: List.xlsx
> (29093-06) Decoding of p003 (Zip archive data, at least v2.0 to extract)
> failed, leaving it unpacked: Maximum number of files (1500) exceeded
> at /usr/sbin/amavisd line 7957.
> (29093-06) NOTICE: Virus scanning skipped: Maximum number of files
> (1500) exceeded at /usr/sbin/amavisd line 7957.
> (29093-06) truncating a message passed to SA at 410405 bytes, orig 1627586
> (29093-06) Passed UNCHECKED, SUBMISSION LOCAL [a.b.c.d] [a.b.c.d] ...
Looks like the archive contained more than 1500 members.
Check the message and try unzipping it manually to make sure.
Clifton Royston wrote:
> Most likely a problem with the "file" program's identification of
> file type. [...]
> The .xlsx format does use Zip compression but it's not a standard zip
> file, and that might be why this one appears to zip to unpack to a
> ridiculous number of files. It shouldn't be getting unzipped in the
> first place.
I disagree. If a content _can_ be unpacked further by any means
available, it should be. Same goes for jar archives, which often
contain hundreds of small files. One can retain the archive
to be passed to a virus scanner along with its members
(@keep_decoded_original_maps), or disable some decoders,
if you like.
Mark
------------------------------------------------------------------------------
Forrester recently released a report on the Return on Investment (ROI) of
Google Apps. They found a 300% ROI, 38%-56% cost savings, and break-even
within 7 months. Over 3 million businesses have gone Google with Google Apps:
an online email calendar, and document program that's accessible from your
browser. Read the Forrester report: http://p.sf.net/sfu/googleapps-sfnew
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
Please visit http://www.ijs.si/software/amavisd/ regularly
For administrativa requests please send email to rainer at openantivirus dot
org
