Quarantining password-protected ZIPs?

[Antony Stone]

On Thursday 03 December 2009, Julian Field wrote:


> Look in MailScanner.conf and search for "Zip-Password". That way you can
> stop them being treated as "Silent Viruses" and so they will be
> quarantined and so on for you.

Thanks for the suggestion.  I currently have:

Silent Viruses = HTML-IFrame All-Viruses

The config file says "Zip-Password: This keyword is not needed if you include 
All-Viruses."  "All-Viruses: .... this includes Zip-Password so you don't 
need to include both"

So, what should I set Silent Viruses to if I want all real viruses to be 
treated silently, but I want Zips with Passwords to be treated non-silently?

Basically, how do I say "All-Viruses except Zip-Password"?


Thanks,

Antony.

> On 02/12/2009 16:16, Antony Stone wrote:
> > Hi.
> >
> > MailScanner has a nice feature to detect when an attachment contains a
> > password-protected ZIP file, and you can specify whether such attachments
> > are permitted or not.
> >
> > I would like to block such attachments by default, storing them in
> > quarantine, and send a notification message to the recipient, or the
> > postmaster, so that if the email is from a trusted source, it can be
> > released and delivered.
> >
> > However, it appears that if a password-protected zip file is discovered,
> > it is treated as though it's a virus, and therefore:
> >
> > a) the original email is thrown away and can't be delivered later
> >
> > b) no notification can be sent to the recipient or the postmaster unless
> > they get these for real viruses too
> >
> > I hope I am I missing something about the configuration options:
> >
> >   - Is it possible to treat password-protected ZIPs like spam instead of
> > like viruses?
> >
> >   - Is it possible to quarantine such attachments, without quarantining
> > all viruses (or archiving all email)?
> >
> > I hope someone can help,
> >
> >
> > Thanks,

-- 
Tinned food was developed for the British Navy in 1813.

The tin opener was not invented until 1858.

                                                     Please reply to the list;
                                                           please don't CC me.