Virus attachments not replaced with warning text

[Markus Wennrich]

On 01.09.2010 16:38, Steve wrote:
> On 26 August 2010 15:24, Steve <stratos.td at gmail.com> wrote:
>
> Maybe not...
>
> The Eicar test ZIP file gets replaced with warning message just fine,
> but I've just received a spam with a ZIP that was flagged with
> {Virus?} but attachment was included.

I've got the same problem. eicar-virus get's removed correctly, all
other viruses are tagged as {VirusInfected} but are still beeing delivered.

My current ugly workaround: declare every virus as non-forging:

    Non-Forging Viruses = ./ e/ a/ i/ o/ u/ -/ r/ s/ t

Now all viruses do get removed ...

> Are there any known issues with 4.79.11 that would cause this?

The problem still exists in 4.81.4 ..

Markus