<div dir="ltr"><div>Check out the <a href="http://www.mailscanner.info/MailScanner.conf.index.html#Silent%20Viruses">http://www.mailscanner.info/MailScanner.conf.index.html#Silent%20Viruses</a> setting<br><br></div>Personally i double check these as this is still a well used attack vector for the bad guys and every now and again you get a sudden increase of the stupid things.<br>
</div><div class="gmail_extra"><br clear="all"><div>-- <br>Martin Hepworth, CISSP<br>Oxford, UK</div>
<br><br><div class="gmail_quote">On 13 June 2014 11:38, Stef Morrell <span dir="ltr"><<a href="mailto:stef@aoc-uk.com" target="_blank">stef@aoc-uk.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi guys,<br>
<br>
I'm struggling a bit with how MS deals with password protected zipfiles, so any of the below could be complete misinterpretation, feel free to correct my ignorance!<br>
<br>
It seems to me that MS detects password protected zips by means of being informed by the virus scanner and then treating it as a virus, using the special keyword Zip-Password in various MailScanner.conf settings.<br>
<br>
And then there is the<br>
<br>
Allow Password-Protected Archives = <yes/no><br>
<br>
setting.<br>
<br>
Somewhere in all this I would like to be able to have a ruleset which says for password protected zipfiles, I can allow them to pass (for users who get them all the time), quarantine (for users who get them occasionally), or default block.<br>
<br>
And I can't for the life of me work out how to achieve this.<br>
<br>
Can anyone advise?<br>
<br>
Thanks<br>
<span class="HOEnZb"><font color="#888888"><br>
Stef<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></span></blockquote></div><br></div>