> Thanks for posting your quarantine-attachments.txt entries. I had a few of > those, but the list sure helped. Also, add: > Information.zip 0 Bagle-H/I
Thanks. The list I got came from Sophos at: http://www.sophos.com/virusinfo/analyses/w32baglei.html and http://www.sophos.com/virusinfo/analyses/w32bagleh.html
According to them, your new one (Information.zip) should be Bagle-J. At least, that is the first variant that lists that file. http://www.sophos.com/virusinfo/analyses/w32baglej.html
> > ...just got it that one. > > File sizes I've seen are: > MoreInfo.pif 12288 bytes > TextFile.zip 12416 bytes > Attach.zip 12420 bytes > Readme.zip 12422 bytes > Information.zip 12420 bytes >
I wonder if the different variants have different sizes. The two that I personally have recieved were both over 20K in size and none of yours are. I guess it is better to leave the size at 0 for now.
> > How about this: Is it possible to put a range in qmail-scanner? e.g.: > .zip 12000-13000 Bagle-H/I
I don't think you can do that right now, but it might be something to add for a future release...
If ranges are added, I suggest we also allow file banning triggered by an attachment file of zero length. It's a length characteristic just as valid as any other number. We could specify file length of "any" with, say, a negative number.
John
Trey Nolen
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
