.zip file passes through the filter

DNSAdmin dnsadmin at 1BIGTHINK.COM
Tue Mar 2 16:09:37 GMT 2004


At 10:19 AM 3/2/2004 -0500, you wrote:
>Hi, all,
>
>We met a .zip virus in our system and have to block all encrypted .zip
>files. I  modified  filename.rules.conf in /opt/MailScanner/etc as
>
>#allow  \.zip$                  -       -
>deny    \.zip$

Wei,
It appears you missed the two TAB characters and the dashes in your deny
line above.

>and in filetype.rules.conf I denied:
>deny    archive         -                       -
>deny    self-extract    No self-extracting archives     No self-extracting
>archives allowed
>
>But the infected .zip file still could pass through the filter. We are
>using the latest mcfee data file.
>
>Any suggestion?
>
>Thanks a lot
>
>Wei



More information about the MailScanner mailing list