[Mimedefang] Virus or Corrupt?

[Evrim ULU]

Steve Ladendorf wrote:

>
> Any ideas??
>
>Here are the warning details:
>
>The attachment Spox Aff.doc contains a known virus.  It has been
>quarantined.
>Here is the output from the virus scanner:
>
>+-------------------------------------------------------+
>|  AntiViral Toolkit Pro by Eugene Kaspersky for Linux  |
>|         Copyright(C) Kaspersky Lab. 1998-2001         |
>|                 Version 3.0  build 135.3              |
>|                                                       |
>+-------------------------------------------------------+
>
>Work/msg-1774-2.doc corrupted.
>  
>

umz. yeps. they are not very comfortable w/ these kind of filenames. 
but, i think it is the right thing to return *infected* when document is 
corrupted. this is simply because we've got lots of macro viruses. If 
the document is corrupted, AVP cannot read the macro and detect viruses 
but microsoft office will try to recover it in some manner. Besides, if 
office is successful and if there exists a real macro virus, you are 
dead. That's all.


c ya.

PS: Hahah, hey, can this be a new kind of virus attack?


evrim.
sysadm
envy inc.