Virus at zip attachments

[haiberg]

Hello,
a customer told us, that he got zip attachment with viruses in it.
So i tested this by myself and found out that's true.

Are zip archives not be checked for viruses?
We are using the clamav virus detection at proxmox.

For my tests i used the folowing ct' checks:
http://www.heise.de/security/dienste/emailcheck/demos/

Best Regards.

 

[tom]

Hello,
a customer told us, that he got zip attachment with viruses in it.
So i tested this by myself and found out that's true.

Are zip archives not be checked for viruses?
We are using the clamav virus detection at proxmox.

For my tests i used the folowing ct' checks:
http://www.heise.de/security/dienste/emailcheck/demos/

Best Regards.

pls email the zip file in a password protected zip file to our support team for analysys, and include your rule config (backup file).

 

[dietmar]

For my tests i used the folowing ct' checks:
http://www.heise.de/security/dienste/emailcheck/demos/

Alls those virus mails are detected and gets blocked. So what mail/virus is not detected?

 

[haiberg]

Alls those virus mails are detected and gets blocked. So what mail/virus is not detected?

I tryed:
ZIP-Archiv mit EXE-Datei
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip_exe_datei

EICAR in ZIP-Archiv
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip_mit_eicar

EICAR in passwortgeschütztem ZIP-Archiv
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=crypt_zip_mit_eicar


@tom
I 'll send you our backup to your support email adress.


Thanx.

 

[tom]

I tryed:
ZIP-Archiv mit EXE-Datei
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip_exe_datei

EICAR in ZIP-Archiv
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip_mit_eicar

EICAR in passwortgeschütztem ZIP-Archiv
http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=crypt_zip_mit_eicar


@tom
I 'll send you our backup to your support email adress.


Thanx.

Just got your configuration and reviewed your rule system. you DISABLED the virus check rule for incoming emails, so its quite clear that viruses goes through ...

 

[haiberg]

Sorry. I had completely overlooked this rule.

Thanks for you fast help!