|
From: Bojan Z. <Boj...@LS...> - 2004-04-14 23:53:18
|
> -----Original Message----- > From: ama...@li... > [mailto:ama...@li...] On Behalf Of > Mark Martinec > Sent: Thursday, 15 April 2004 5:14 a.m. > To: AMa...@li... > Subject: Re: [AMaViS-user] Log error > > Jim, > > | amavis[18681]: (18681-02) do_executable/do_unzip failed, ignoring: > | IO error: reading data : > > I don't know why you get IO error, but it is probably due to a > malformed zip or some executable that is not a > self-extracting zip at all. > > It is more common to see messages like: > do_executable/do_unzip failed, ignoring: format error: bad > signature:... > > It may depend on the version of Archive::Zip and Compress::Zlib > you have on the system. Probably - I didn't bother investigating this as it stops malware properly, but the error Jim wrote about is (at least where I can see it) caused by Sober-F worm. I guess it does something weird with the zip archive, which causes that error: (02601-01-80) do_executable/do_unzip failed, ignoring: IO error: seeking to local header : Invalid argument But it's properly detected: (02601-01-80) INFECTED (W32/Sober-F) Cheers, Bojan |