<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div dir="ltr"><span>I got this working today! I compiled the latest clam and got the clamd</span></div><div dir="ltr"><span>running on my box. I had to tweak some mailscanner stuff and got the </span></div><div dir="ltr"><span>sanesecurity dbs downloading. So far I have not found a bad macro </span></div><div dir="ltr"><span>doc or xls that the badmacro.ndb doesn't pickup on. </span></div><div class="qtdSeparateBR" id="yui_3_16_0_1_1455090647233_3296"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_1_1455090647233_3269" style="display: block;"> <div id="yui_3_16_0_1_1455090647233_3268" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1455090647233_3267" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1455090647233_3270" dir="ltr"> <font id="yui_3_16_0_1_1455090647233_3298" face="Arial" size="2"> <hr size="1" id="yui_3_16_0_1_1455090647233_3297"> <b><span style="font-weight: bold;">From:</span></b> Steve Basford <steveb_clamav@sanesecurity.com><br> <b><span style="font-weight: bold;">To:</span></b> MailScanner Discussion <mailscanner@lists.mailscanner.info> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, February 8, 2016 2:49 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Virus Parser<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_1_1455090647233_3266"><br><br clear="none">On Mon, February 8, 2016 7:32 pm, Peter Lemieux wrote:<br clear="none"><br clear="none"><br clear="none">><br clear="none">> ScanOLE2 yes<br clear="none">> OLE2BlockMacros yes<br clear="none">><br clear="none">><br clear="none">> then files with macros will be treated as malware. The macros will not<br clear="none">> be stripped though. The message will be quarantined by MailScanner like<br clear="none">> any other piece of malware. In the organization I consult to, ordinary<br clear="none">> users have no need of files with macros, so blocking them all is the<br clear="none">> easiest solution.<br clear="none"><br clear="none">Agreed the above option changes do work... but a lot of my users at work<br clear="none">, do have a lot of macros embedded in various price lists etc, which got<br clear="none">blocked by these options... hence badmacro.ndb was born :)<br clear="none"><br clear="none">Cheers,<br clear="none"><br clear="none">Steve<br clear="none">Web : sanesecurity.com<br clear="none">Blog: sanesecurity.blogspot.com<br clear="none">Twitter: @sanesecurity<div class="yqt8830196436" id="yqtfd90822"><br clear="none"><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">MailScanner mailing list<br clear="none"><a id="yui_3_16_0_1_1455090647233_3299" href="mailto:mailscanner@lists.mailscanner.info" shape="rect" ymailto="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br clear="none"><a id="yui_3_16_0_1_1455090647233_3300" href="http://lists.mailscanner.info/listinfo/mailscanner" target="_blank" shape="rect">http://lists.mailscanner.info/listinfo/mailscanner</a><br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>