Problem with password protected spreadsheets

[Matt Kettler]

Tony Canning wrote:
> I have a problem which is upsetting several of our network users - password protected excel (.xls) files are not delivered, in-bound or out-bound. 
> 
> I am using MailScanner-4.57.6, with Sophos, ClamAV & Spamassassin under Solaris. 
> Here is a sample of the problem from the system log:
> 
> Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning: ClamAV found 1 infections
> Mar 13 17:03:31 localhost MailScanner[6078]: Infected message l2DH2wid008740 came from 172.16.1.13
> Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning: Found 1 viruses
> Mar 13 17:03:31 localhost MailScanner[6078]: <A> tag found in message l2DH2wid008740 from v.harwood-smart at foe.co.uk
> Mar 13 17:03:31 localhost MailScanner[6078]: Virus Scanning completed at 959 bytes per second
> Mar 13 17:03:31 localhost MailScanner[6078]: Viruses marked as silent: Password protected file ./l2DH2wid008740/rolling phone upgrade gift aid decs.zip/rolling phone upgrade gift aid decs.txt 
> 
> It appears from the above that ClamAV is treating it as false positive virus?

That's not a password protected XLS, it's a password protected .zip file
containing a .txt file.


> I have the following parameters configured:
> 
> Silent Viruses = HTML-IFrame All-Viruses
> Still Deliver Silent Viruses = no
> Block Encrypted Messages = no
> Allow Password-Protected Archives = yes
> Allowed Sophos Error Messages = "File was encrypted"
>


>From the looks of it, you're using clamav, not clamavmodule.

do you have the "block-encrypted" option in /usr/lib/MailScanner/clamav-wrapper?