block F-Secure "Internal error: Bad file"-files

[Patrik Bäckström]

Unfortunately i don't have a copy of the file :-(

Since it's not detected as a virus it's not placed in the quarantine. I'll
have to ask the recipient(s) and see if they still have a copy.

Anyway, here is the messages logged by fsav and mailscanner:

Jun  3 10:46:09 hostname fsavd: Failed to scan file
<snip>/mailscanner/tmp/7066/./0C3511C64AD/ReMailer-6418.doc.zip: Internal
error: Bad file [ArchiveScanner].

Jun  3 10:46:09 hostname MailScanner[7066]: 21 files could not be scanned

If you look in the fsav documentation
(http://www.f-secure.com/products/anti-virus/linux/fsav.shtml) there is a
bunch of different error-messages that indicate that the scan failed for
this or that reason. It would be neat if there was an option i MailScanner
to block files if and when the virusscanner exits with one of these
error-messages.

Even if F-Secure fixes the problem with extracting some types of ZIP-files,
there could be some other reasons for the scanner to fail and then i would
rather see the message being blocked than let through unscanned.

/pb

----- Original Message -----
From: "Julian Field" <mailscanner at ECS.SOTON.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Thursday, June 03, 2004 2:48 PM
Subject: Re: block F-Secure "Internal error: Bad file"-files


> I suggest you forward this to F-Secure tech support. They are about to
> release a new version and you may find it is fixed in there.
>
> If you put one of the troublesome files on a website somewhere I can get
it
> from, I will test it out for you and let you know what happens. I will
then
> add functionality to MailScanner to support this if it still happens with
> the new version and is a common problem.
>
> At 12:49 03/06/2004, you wrote:
> >On some files, mostly .zip, F-Secure failes to scan the file and returns
the
> >errormessage "Internal error: Bad file [ArchiveScanner]".
> >
> >This is, ofcourse, a problem with F-Secure. However, i want to block
files
> >which F-Secure can't scan since there is no way of knowing what's inside
> >them. How do i make MailScanner do that?
> >
> >/pb
> >
> >-------------------------- MailScanner list ----------------------
> >To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> >Before posting, please see the Most Asked Questions at
> >http://www.mailscanner.biz/maq/     and the archives at
> >http://www.jiscmail.ac.uk/lists/mailscanner.html
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> -------------------------- MailScanner list ----------------------
> To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
> Before posting, please see the Most Asked Questions at
> http://www.mailscanner.biz/maq/     and the archives at
> http://www.jiscmail.ac.uk/lists/mailscanner.html
>
>

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html