Problem with password protected spreadsheets

[Tony Canning]

I have a problem which is upsetting several of our network users - password protected excel (.xls) files are not delivered, in-bound or out-bound. 

I am using MailScanner-4.57.6, with Sophos, ClamAV & Spamassassin under Solaris. 
Here is a sample of the problem from the system log:

Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning: ClamAV found 1 infections
Mar 13 17:03:31 localhost MailScanner[6078]: Infected message l2DH2wid008740 came from 172.16.1.13
Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning: Found 1 viruses
Mar 13 17:03:31 localhost MailScanner[6078]: <A> tag found in message l2DH2wid008740 from v.harwood-smart at foe.co.uk
Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning completed at 959 bytes per second
Mar 13 17:03:31 localhost MailScanner[6078]: Viruses marked as silent: Password protected file ./l2DH2wid008740/rolling phone upgrade gift aid decs.zip/rolling phone upgrade gift aid decs.txt 

It appears from the above that ClamAV is treating it as false positive virus?

I have the following parameters configured:

Silent Viruses = HTML-IFrame All-Viruses
Still Deliver Silent Viruses = no
Block Encrypted Messages = no
Allow Password-Protected Archives = yes
Allowed Sophos Error Messages = "File was encrypted"


The only way around this that I have found so far is to exempt scanning completely for 
the sender and/or recepient in scan.messages.rules, but this is not very satisfactory.

I'd be most grateful for any advice.

Tony Canning
Infrastructure Officer
Friends of the Earth England, Wales & N.Ireland