[Mimedefang] Password Protected Zip file - Containing Virus (f-protd)

[Lucas Albers]

Larry Starr said:
> I have been seeing a number of messages containing Password Protected
".zip"
> files,

I was trying to determine how to just block encrypted zip files.
My code does not work so far, but here is a nice starting place:
http://lists.roaringpenguin.com/pipermail/mimedefang/2004-January/019511.html

Then to block encrypted zip files with infozip, the regular expression
would be:
if ($result =~ /file security status:\s+encrypted/

You can do this two ways:
call an external program to return zip structure.
or cal perl zip module to return zip structure.

-- 
Luke Computer Science System Administrator
Security Administrator,College of Engineering
Montana State University-Bozeman,Montana