MailScanner issue not detecting MyDoom-0 [Re: nested .zip containing bad files not being caught]

[Julian Field]

The problem isn't quite as you have been describing it, but it causes the
symptom you are seeing.
Attached is a new Message.pm. Sorry I haven't got a patch but this is at
short notice and I can't get my VPN connection to stay up for more than 2
minutes at a time through this hotel's network.

At 22:06 26/07/2004, you wrote:
>Drew,
>
>Drew Marshall said the following on 26-Jul-04 22:42:
>>Stijn Jonker wrote:
>>
>>>The longer explanation is below, but as far as I can tell the reason for
>>>non detection is that the zip file inside the original zip file has the
>>>same name. I think the explanation is below, and it is pointing towards
>>>mailscanner.
>>
>>Interestingly I can't get anything to detect a problem with these two
>>files either zipped or not. Very strange as they must be viruses but
>>neither f-prot or clam want to find anything wrong... I have the latest
>>definitions
>
>Could you check the files within: http://www.sjc.nl/MS/ for me?
>
>These are the two that are causing me issues?
>
>Maybe it's not the same as Bob is seeing.
>
>--
>Met Vriendelijke groet/Yours Sincerely
>Stijn Jonker <SJCJonker at sjc.nl>
>
>-------------------------- MailScanner list ----------------------
>To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
>Before posting, please see the Most Asked Questions at
>http://www.mailscanner.biz/maq/     and the archives at
>http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Message.pm
Type: application/octet-stream
Size: 151684 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20040727/9e5c9a3e/Message.obj
-------------- next part --------------
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html