On Thu, 25 Mar 2004, 04:36 GMT-08 Nancy McGough wrote:
And if you are using an earlier version of VSnag, you can set
this:
NASTYEXT="(bat|cmd|com|zip|exe|hta|pif|scr|shs|vb[se]|ws[fh]|(doc|txt|xls)\.)"
^^^^^^^^^^^^^^^^
this part is not in the default NASTYEXT
Or, you can use the set of procmail recipes available at
http://softlabsav.sourceforge.net/
Nothing has to be changed from the default settings to catch infected
mails that have a virus attached inside a zip archive. The zip archive
can even be encrypted. Since 10 days, it freed me from 105 zipped
viruses:
[root(_at_)ns mail]# cat viruses.log | grep -c ZIP.
105
If someone is interested which kind of bad zip attachments this have
been, here are the details (most recent viruses at the bottom):
[root(_at_)ns mail]# cat viruses.log | grep ZIP.
roal: 20040314 ZIP.exe 22140 jokes.zip Zip archive
data 200403141043(_dot_)FAA21834(_at_)anet(_dot_)at
roal: 20040314 ZIP.scr 25481 secrets.zip Zip archive
data 200403141536(_dot_)KAA23054(_at_)anet(_dot_)at
roal: 20040314 ZIP.com 25479 schock.zip Zip archive
data 200403142348(_dot_)SAA24783(_at_)anet(_dot_)at
roal: 20040314 ZIP.com 22136 website.zip Zip archive
data 200403150131(_dot_)UAA25147(_at_)anet(_dot_)at
roal: 20040314 ZIP.scr 22144 details.zip Zip archive
data 200403150322(_dot_)WAA25385(_at_)anet(_dot_)at
roal: 20040315 EZIP.exe 12420 TextFile.zip Zip archive
data uysmlujbrcjwpcpgdhp(_at_)anet(_dot_)at
roal: 20040315 ZIP.com 22150 creditcard.zip Zip archive
data 200403150712(_dot_)CAA26056(_at_)anet(_dot_)at
roal: 20040315 ZIP.pif 22136 doc.zip Zip archive data
200403151324(_dot_)IAA28587(_at_)anet(_dot_)at
roal: 20040316 ZIP.scr 22142 shower.zip Zip archive
data 200403160836(_dot_)DAA02519(_at_)anet(_dot_)at
roal: 20040316 ZIP.exe 25473 attach2.zip Zip archive
data 200403161323(_dot_)IAA05241(_at_)anet(_dot_)at
roal: 20040316 ZIP.pif 25481 secrets.zip Zip archive
data 200403161853(_dot_)NAA07893(_at_)anet(_dot_)at
roal: 20040316 ZIP.scr 25479 attach2_me.zip Zip archive
data 200403170348(_dot_)WAA10627(_at_)anet(_dot_)at
roal: 20040316 ZIP.exe 25469 story.zip Zip archive
data 200403170423(_dot_)XAA10830(_at_)anet(_dot_)at
roal: 20040316 ZIP.com 22142 shower.zip Zip archive
data 200403170426(_dot_)XAA10910(_at_)anet(_dot_)at
roal: 20040317 ZIP.exe 22140 topseller.zip Zip archive
data 200403170739(_dot_)CAA11778(_at_)anet(_dot_)at
roal: 20040317 ZIP.pif 25475 talk.zip Zip archive
data 200403171319(_dot_)IAA14416(_at_)anet(_dot_)at
roal: 20040318 ZIP.scr 25477 mails.zip Zip archive
data 200403181423(_dot_)JAA23487(_at_)anet(_dot_)at
roal: 20040318 ZIP.com 25493 posting_found.zip Zip
archive data 200403182122(_dot_)QAA26418(_at_)anet(_dot_)at
roal: 20040318 ZIP.pif 22138 talk.zip Zip archive
data 200403182351(_dot_)SAA27271(_at_)anet(_dot_)at
roal: 20040318 ZIP.scr 25469 image.zip Zip archive
data 200403190015(_dot_)TAA27405(_at_)anet(_dot_)at
roal: 20040319 ZIP.scr 25487 more_454543403.zip Zip
archive data 200403191341(_dot_)IAA32113(_at_)anet(_dot_)at
roal: 20040319 ZIP.com 25491 number_phone.zip Zip
archive data 200403191342(_dot_)IAA32188(_at_)anet(_dot_)at
roal: 20040320 EZIP.exe 12424 TextFile.zip Zip archive
data 1245366238(_dot_)20040320174708(_at_)chello(_dot_)at
roal: 20040322 ZIP.com 22138 document.zip Zip archive
data 200403220816(_dot_)DAA19460(_at_)anet(_dot_)at
roal: 20040322 ZIP.exe 22144 website.zip Zip archive
data 200403221324(_dot_)IAA21927(_at_)anet(_dot_)at
roal: 20040322 ZIP.pif 22152 information.zip Zip archive
data 200403221420(_dot_)JAA22355(_at_)anet(_dot_)at
roal: 20040322 ZIP.scr 29840 old_photos.zip Zip archive
data 200403221507(_dot_)KAA22706(_at_)anet(_dot_)at
roal: 20040322 ZIP.exe 29832 document_all.zip Zip
archive data 200403221540(_dot_)KAA23157(_at_)anet(_dot_)at
roal: 20040322 ZIP.pif 22144 website.zip Zip archive
data 200403221554(_dot_)KAA23262(_at_)anet(_dot_)at
roal: 20040322 ZIP.pif 25475 sexy.zip Zip archive
data 200403221617(_dot_)LAA23467(_at_)anet(_dot_)at
roal: 20040322 ZIP.pif 29834 software.zip Zip archive
data 200403222032(_dot_)PAA25247(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 document_info.zip Zip
archive data 200403230858(_dot_)DAA27676(_at_)anet(_dot_)at
roal: 20040323 ZIP.scr 29840 important.zip Zip archive
data 200403230936(_dot_)EAA28209(_at_)anet(_dot_)at
roal: 20040323 ZIP.scr 29840 old_photos_webmaster.zip
Zip archive data 200403231147(_dot_)GAA29494(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 25495 dinner_release.zip Zip
archive data 200403231316(_dot_)IAA30230(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 document04.zip Zip archive
data 200403231530(_dot_)KAA30887(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 data_info.zip Zip archive
data 200403231557(_dot_)KAA31031(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 22138 note.zip Zip archive
data 200403231619(_dot_)LAA31262(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 excel document_info.zip Zip
archive data 200403231624(_dot_)LAA31362(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 postcard.zip Zip archive
data 200403231636(_dot_)LAA31554(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 file.zip Zip archive
data 200403231811(_dot_)NAA32120(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 document_all02c_webmaster.zip
Zip archive data 200403231933(_dot_)OAA32515(_at_)anet(_dot_)at
roal: 20040323 ZIP.scr 22138 aboutyou.zip Zip archive
data 200403231946(_dot_)OAA32657(_at_)anet(_dot_)at
roal: 20040323 ZIP.pif 29834 readme.zip Zip archive
data 200403231954(_dot_)OAA32709(_at_)anet(_dot_)at
roal: 20040323 ZIP.scr 25467 visa.zip Zip archive
data 200403232138(_dot_)QAA00763(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 document.zip Zip archive
data 200403240052(_dot_)TAA01629(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 document.zip Zip archive
data 200403240342(_dot_)WAA02371(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 document_with_notice.zip
Zip archive data 200403240342(_dot_)WAA02369(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 message.zip Zip archive
data 200403240344(_dot_)WAA02496(_at_)anet(_dot_)at
roal: 20040323 ZIP.scr 29840 data.zip Zip archive
data 200403240353(_dot_)WAA02566(_at_)anet(_dot_)at
roal: 20040323 ZIP.exe 29832 list.zip Zip archive
data 200403240354(_dot_)WAA02646(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 details.zip Zip archive
data 200403240635(_dot_)BAA03534(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 document_webmaster.zip Zip
archive data 200403240650(_dot_)BAA03692(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 abuses.zip Zip archive
data 200403240650(_dot_)BAA03739(_at_)anet(_dot_)at
roal: 20040324 ZIP.com 22140 mails.zip Zip archive
data 200403240700(_dot_)CAA03862(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 info02.zip Zip archive
data 200403240800(_dot_)DAA04254(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 document.zip Zip archive
data 200403240801(_dot_)DAA04307(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 file.zip Zip archive
data 200403240823(_dot_)DAA04506(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 abuselist.zip Zip archive
data 200403240824(_dot_)DAA04554(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 id09509.zip Zip archive
data 200403240908(_dot_)EAA05177(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 message.zip Zip archive
data 200403240911(_dot_)EAA05295(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 data.zip Zip archive
data 200403240911(_dot_)EAA05297(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 id43342.zip Zip archive
data 200403240931(_dot_)EAA05611(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 document_roal.zip Zip
archive data 200403240931(_dot_)EAA05661(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 message_roal.zip Zip
archive data 200403240931(_dot_)EAA05685(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 document.zip Zip archive
data 200403240931(_dot_)EAA05711(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 email.zip Zip archive
data A1XvpFVjC000000a0(_at_)exchange(_dot_)LATSCHBACHER(_dot_)local
roal: 20040324 ZIP.scr 29840 text_roal.zip Zip archive
data 200403241300(_dot_)IAA07393(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 22136 nomoney.zip Zip archive
data 200403241300(_dot_)IAA07472(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 about_you.zip Zip archive
data 200403241329(_dot_)IAA07691(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 msg.zip Zip archive data
200403241344(_dot_)IAA07847(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 data.zip Zip archive
data 200403241345(_dot_)IAA07872(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 sample01_roal.zip Zip
archive data 200403241345(_dot_)IAA07896(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 your_doc.zip Zip archive
data 200403241346(_dot_)IAA07920(_at_)anet(_dot_)at
roal: 20040324 ZIP.com 22132 story.zip Zip archive
data 200403241512(_dot_)KAA08686(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29856 message_info.zip Zip
archive data 200403241529(_dot_)KAA08837(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 old_photos_info.zip Zip
archive data 200403241538(_dot_)KAA09031(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29856 your_document.zip Zip
archive data 200403241549(_dot_)KAA09160(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 details.zip Zip archive
data 200403241555(_dot_)KAA09239(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 sample01.zip Zip archive
data 200403241555(_dot_)KAA09332(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 document05.zip Zip archive
data 200403241726(_dot_)MAA10151(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 document.zip Zip archive
data 200403241915(_dot_)OAA11140(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 email.zip Zip archive
data 200403242004(_dot_)PAA11469(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 details_info.zip Zip
archive data 200403242005(_dot_)PAA11516(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 information.zip Zip archive
data 200403242055(_dot_)PAA11801(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 letter.zip Zip archive
data 200403242107(_dot_)QAA12092(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 message.zip Zip archive
data 200403242109(_dot_)QAA12142(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 websites01_info.zip Zip
archive data 200403242157(_dot_)QAA12622(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 attach.zip Zip archive
data 200403242258(_dot_)RAA13021(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 postcard.zip Zip archive
data 200403250001(_dot_)TAA13503(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 data.zip Zip archive
data 200403250031(_dot_)TAA13725(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 document.zip Zip archive
data 200403250144(_dot_)UAA14254(_at_)anet(_dot_)at
roal: 20040324 ZIP.exe 29832 document.zip Zip archive
data 200403250220(_dot_)VAA14489(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 readme.zip Zip archive
data 200403250319(_dot_)WAA14698(_at_)anet(_dot_)at
roal: 20040324 ZIP.scr 29840 bill.zip Zip archive
data 200403250327(_dot_)WAA14842(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 message.zip Zip archive
data 200403250410(_dot_)XAA14996(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 data20_info.zip Zip archive
data 200403250411(_dot_)XAA15045(_at_)anet(_dot_)at
roal: 20040324 ZIP.pif 29834 details_info.zip Zip
archive data 200403250457(_dot_)XAA15350(_at_)anet(_dot_)at
roal: 20040325 ZIP.scr 29840 bill.zip Zip archive
data 200403250540(_dot_)AAA15855(_at_)anet(_dot_)at
roal: 20040325 ZIP.pif 29834 software_info.zip Zip
archive data 200403250542(_dot_)AAA15940(_at_)anet(_dot_)at
roal: 20040325 ZIP.scr 29840 news01.zip Zip archive
data 200403250627(_dot_)BAA16110(_at_)anet(_dot_)at
roal: 20040325 ZIP.exe 29832 document.zip Zip archive
data 200403250628(_dot_)BAA16196(_at_)anet(_dot_)at
roal: 20040325 ZIP.exe 25489 worker_more.zip Zip archive
data 200403250854(_dot_)DAA17210(_at_)anet(_dot_)at
roal: 20040325 ZIP.exe 29832 part6.zip Zip archive
data 200403250901(_dot_)EAA17346(_at_)anet(_dot_)at
roal: 20040325 ZIP.exe 29832 story_info.zip Zip archive
data 200403250906(_dot_)EAA17610(_at_)anet(_dot_)at
best,
rob.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail