Re: Multiple malware scanners

Chris Edwards wrote:
> Here we block most dangerous filetypes outright.  However, we allow .zip
> files and hence we're vulnerable to .zip viruses that arrive before the AV
> updates.

We also reject all executable file types, but allow zips.  However, our 
AV software on the Exchange server (McCrappy) will quarantine the ZIP 
file but allow the message through.  Our mail volume is low enough that 
I can release quarantined files on request.

> Not sure what the answer is.  Some have suggested a form of greylisting
> whereby such mails are delayed for an interval hopefully long enough to
> allow AV updates to appear.

I'd like to be able to look inside ZIP files, and deny if there are 
executables present.  Executables should never be passed via e-mail, 
IMHO.  I'd rather setup some type of web-accessible dropbox.

Slightly on topic, does anyone know how to reject password protected ZIPs?

Steven
-- 
Steven Dickenson <[email protected]>
http://www.mrchuckles.net