Fwd: RE: [ILUG] Amavis

[Darragh Bailey]

----- Forwarded message from Darragh Bailey <felix at compsoc.nuigalway.ie> -----
    Date: Thu,  4 Mar 2004 13:12:28 +0000
    From: Darragh Bailey <felix at compsoc.nuigalway.ie>
Reply-To: Darragh Bailey <felix at compsoc.nuigalway.ie>
 Subject: RE: [ILUG] Amavis
      To: Dermot Daly <dermot.daly at itsmobile.com>

Quoting Dermot Daly <dermot.daly at itsmobile.com>:

> The latest Bagle viruses include zip files which are password protected
> - The mail body includes the password so that uninformed users will use
> this to open the zip, and thus propagate the virus.
> 
> Anti-Virus products cannot open the zip due to the fact that it is
> password protected (this is the reason behind the password protection).
> 
> Might be worth telling your users to not open any zip files that require
> a password - Most likely this will be bagle.
> 
> Cheers,
> Dermot.

I'm hearing reports on focus-virus at securityfocus that it appears to be only 
Kaspersky Labs anti-virus is the only one intelligent enough to check for a 
password in the email and uses it to open up the zip file and then scan for the 
virus.

I'd imagine that most of AV vendors will have to update their engines to 
provide this functionality soon otherwise it this method will be used to slip 
any virus past the scanner.

- -- 
Darragh

"Nothing's foolproof to a sufficently talented fool"

- ----- End forwarded message -----

Aargh! really hate it when I forget to use reply to all :(

- -- 
Darragh

"Nothing's foolproof to a sufficently talented fool"