[Esd-l] Trapped zip file logging
Smart,Dan
SmartD at VMCMAIL.com
Thu Mar 4 07:03:27 PST 2004
John, Could you modify your logging for zip files?
In my log I see the following:
================================================
Checking ZIP archive "Info.zip" for poisoning.
Decoding to "/tmp/mailchk.JyuzAS"
Checking zipped "xvpol.exe"
Trapped "xvpol.exe".
================================================
Could the last line say something like "Trapped zipped executable "
I parse these messages for reporting purposes, and this would make for a
simpler grep, as
Trapped excessively long header in
Trapped poisoned executable
Also will come back from a "Trapped" grep
I guess an egrep 'Trapped \"' would get what I want, but just a
suggestion...
<<Dan>>
More information about the esd-l
mailing list