Block macro word documents

Steve Basford steveb_clamav at sanesecurity.com
Mon Dec 14 16:29:09 UTC 2015


On Mon, December 14, 2015 4:23 pm, Jerry Benton wrote:
> If you are using clam, you can block all macros. You can also add Sophos
> to your system for free and it might pickup what clam does not. None of
> the AV engines seem to be doing a good job of catching malicious macros.
>
If you use Sanesecuriy signatures:

Make sure you use: badmacro.ndb

If you want to block EVERYTHING MACRO you can use clamd.conf

OLE2BlockMacros on

But for me, the above clamd.conf entry blocked lots of legitimate macros
from customers...

Cheers,

Steve
Web : sanesecurity.com
Blog: sanesecurity.blogspot.com



More information about the MailScanner mailing list