I haven't hit a single file as yet with this filter. It may be that this was in fact fixed with a more recent version of Declude Virus (I wish there were notes for this stuff so we wouldn't have to waste time). The filter should however potentially hit other corrupted viruses such as very short partial attachments that are bounced by some servers unless the new 'invalid' checks in Declude Virus are using much the same technique, or one that is indicative of the same thing (i.e. Base64 encoding that aren't ended properly). It might be more useful looking at files up to 5K in size.
Thanks for the heads up.
Matt
Scott Fisher wrote:
I think the vulnerability checks are catching 0/1 length files. I haven't seen one lately. That said, your e-mail numbers well surpass mine, so I might just be luckier.
From my virus logs:07/04/2004 08:13:21 Q024e0094005eb63a MIME file: message.zip [base64; Length=0 Checksum=1441] 07/04/2004 08:13:21 Q024e0094005eb63a Invalid ZIP Vulnerability 07/04/2004 08:13:21 Q024e0094005eb63a Found a bogus .zip file 07/04/2004 08:13:21 Q024e0094005eb63a File(s) are INFECTED [[Invalid ZIP Vulnerability]: 0] 07/16/2004 22:06:41 Q97bd04d80048162e MIME file: Document.scr [base64; Length=0 Checksum=2668] 07/16/2004 22:06:41 Q97bd04d80048162e Invalid SCR Vulnerability 07/06/2004 16:56:14 Q1ffd0209020ca170 MIME file: Info.scr [base64; Length=1 Checksum=2753] 07/06/2004 16:56:14 Q1ffd0209020ca170 Invalid SCR Vulnerability 07/06/2004 16:56:14 Q1ffd0209020ca170 Banning file with scr extension [application/octet-stream]. 07/06/2004 16:56:14 Q1ffd0209020ca170 MIME file: Sources.zip [base64; Length=1 Checksum=2753] 07/06/2004 16:56:15 Q1ffd0209020ca170 Invalid ZIP Vulnerability 07/06/2004 16:56:15 Q1ffd0209020ca170 Found a bogus .zip file
<<< [EMAIL PROTECTED] 7/19 4:58p >>>
I thought I would share this one with the list since it's been a while and the problem that this targets is rather problematic in nature, though not very threatening. This filter targets messages sent by virus infected computers that are missing the attachment but define the file. This results in a zero-byte attachment and it will always get past Declude Virus, even if it has one of the commonly banned extensions associated with viruses (unless this has been addressed in a more recent interim that I'm not aware of ).
This filter uses the Size.vbs external test (which is also shared in the beta section of the site) to determine if the message is of a certain size. In the filter that I have provided, it is looking for a entry that matches "SIZE-XS" which on my system is set to 2K or smaller. If if finds such a message, it then checks to see if there are indications of an attachment and if so, is there an indication of BASE64 being properly encoded (always ends with two equal signs then a double line break), and if not, then it checks for an indication of one of 9 file extensions and scores them. The logic here is that a message containing an attachment of one of these types really shouldn't be smaller than 2K, and even if they were they should be properly encoded, but a corrupted virus that sends a zero-byte attachment should fail. Messages with very small attachments should not trip this test, however it has only been designed to work properly with BASE64 attachments which are the obvious mechanism for almost every mass mailing virus out there because of broad support.
I haven't documented the file, so here's the configuration that I use for Size.vbs on my system as it corresponds to the test:
SIZE-XXS external 11 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 2 0
SIZE-XS external 12 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 0 0
SIZE-S external 13 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 0 0
SIZE-M external 14 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 0 0
SIZE-L external 15 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 0 0
SIZE-XL external 16 "CScript C:\IMail\Declude\Filters\Size.vbs //B //NoLogo //T:2 .5,2,30,100,300,1000 %WEIGHT% 28" 0 0
SIZE-XXL external 17 "CScrip
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
