Blocking extensions inside of zip files

[shrek-m at gmx.de]

Tristan Rhodes wrote:

>At work we use another antivirus solution (not my decision), and we have been manually adding the infected .zip files to our blocked attachment list.  We don't want to block all .zip files, and the virus definitions haven't been updated yet (or we haven't downloaded them yet.  Again not my decision).  So this is our best solution, blocking by filename.
>
>

outsch

>file.zip
>document.zip
>body.zip
>* more may be added as we see them
>

# unzip -t /data4/doku/viren/zip/qbzy.zip
Archive:  /data4/doku/viren/zip/qbzy.zip
    testing: qbzy.scr                 OK
No errors detected in compressed data of /data4/doku/viren/zip/qbzy.zip.

# sweep -archive /data4/doku/viren/zip/qbzy.zip
 >>> Virus 'W32/MyDoom-A' gefunden in Datei
/data4/doku/viren/zip/qbzy.zip/qbzy.scr
 >>> Virus 'W32/MyDoom-A' gefunden in Datei /data4/doku/viren/zip/qbzy.zip

--
shrek-m