RE: [AMaViS-user] Log error

[Bojan Z. <Boj...@LS...>]

 

> -----Original Message-----
> From: ama...@li... 
> [mailto:ama...@li...] On Behalf Of 
> Mark Martinec
> Sent: Thursday, 15 April 2004 5:14 a.m.
> To: AMa...@li...
> Subject: Re: [AMaViS-user] Log error
> 
> Jim,
> 
> | amavis[18681]: (18681-02) do_executable/do_unzip failed, ignoring:
> |   IO error: reading data :
> 
> I don't know why you get IO error, but it is probably due to a
> malformed zip or some executable that is not a 
> self-extracting zip at all.
> 
> It is more common to see messages like:
>   do_executable/do_unzip failed, ignoring: format error: bad 
> signature:...
> 
> It may depend on the version of Archive::Zip and Compress::Zlib
> you have on the system.

Probably - I didn't bother investigating this as it stops malware properly,
but the error Jim wrote about is (at least where I can see it) caused by
Sober-F worm. I guess it does something weird with the zip archive, which
causes that error:

(02601-01-80) do_executable/do_unzip failed, ignoring: IO error: seeking to
local header : Invalid argument

But it's properly detected:

(02601-01-80) INFECTED (W32/Sober-F)


Cheers,

Bojan