Re: [exim] an antivirus for zero-day :)

2017-09-29 Thread Lena--- via Exim-users
One more correction: set acl_m_ud = ${sg{$mime_decoded_filename}{[^/]+\$}{}} condition = ${run{SHELL -c \ "cd $acl_m_ud; \ P7ZIP x -y $mime_decoded_filename; \ GREP -r -a -s -E \ 'rundll32|This program cannot be run in DOS mode|\

Re: [exim] an antivirus for zero-day :)

2017-09-28 Thread Lena--- via Exim-users
Correction: condition = ${run{SHELL -c \ "cd ${sg{$mime_decoded_filename}{[^/]+\\$}{}}; \ P7ZIP x -y $mime_decoded_filename; \ GREP -r -a -s -E \ 'rundll32|This program cannot be run in DOS mode' \ *"}{1}{0}} -- ## List details at

[exim] an antivirus for zero-day :)

2017-09-28 Thread Lena--- via Exim-users
> From: Paul Lenz > > > I wrote a plugin for Spamassassin which unzips every attachement and > > > (IMHO very important) unzips every MS Office file (xlsx, xlsm, docx) and > > > looks for strings like "rundll32" or "This program cannot be run in DOS > > > mode" and some