On Wed, 2004-03-10 at 22:59, Andreas Schulze-H�drich wrote:
> Has anybody written a patch to detect password protected files?

Qmail-Scanner 1.21 will be released tomorrow. It has a new option
"--block-password-protected" (disabled by default) that will do what you
want.

Note: please talk to your AV vendor for an update. All AVs should now be
able to handle the current slew of password-protected zip file viruses. 

Note 2: you probably need to be running Q-S with the "--redundant yes"
option to allow the AV access to the original message

(note: I'm not saying they can unpack the file to find the virus - they
are doing pretty lame brute string checks by the looks of it. So I am
expecting to use the "--block-password-protected" option myself from
time-to-time while waiting for the next pattern update...)

Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general

Reply via email to