q# wrote:
On Wed, Jul 27, 2005 at 10:46:42AM -0700, [EMAIL PROTECTED] wrote:
Is there currently a work around to avoid this situation? Is anyone just
rejecting messages with a zip that has a zip header that says the file
size is Zero when uncompressed?
Could you be more specific, I don't understand what you mean. You want
reject zip files with empty files inside, yes? Like this:
$ unzip -vl /tmp/empty.zip
Archive: /tmp/empty.zip
Length Method Size Ratio Date Time CRC-32 Name
-------- ------ ------- ----- ---- ---- ------ ----
0 Stored 0 0% 07-27-05 19:58 00000000 empty.txt
-------- ------- --- -------
0 0 0% 1 file
I believe the OP is referring to a new technique being used by virus
writers where the email has a zip attachment which APPEARS to be 0 bytes
(in the zip header) but when uncompressed, the file is in fact not 0
bytes. There was a recent article about this somewhere but i am unable
to find the link ATM.
-Jim
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
