Need help for spam filter

[chandu]

Hi,

I need urgent help regarding spm filtering.
Our new client supposed to get their payslip from their payroll company but that all paylip attchment ( zip files) and getting blocked by spam filter...its very imp mail communication for them..i have goned through below link :

Improving Anti-spam system - Zimbra :: Wiki

and put the white list in /opt/zimbra/conf/salocal.cf.in


whitelist_from *@example.com

at the end of the file ...and restarted zmamavisdctl and ask user to check but still its getting blocked..

#################################################
i have below setting :
tag Percentage : 33
kill percentage : 66

######################################

in admin inbox i m getting below report :

A virus was found: Encrypted.Zip

Scanner detecting a virus: ClamAV-clamd

Content type: Virus
Internal reference code for the message is 02622-06/ITe5W1RqeS4k

First upstream SMTP client IP address: [64.12.10.30] unknown
According to a 'Received:' trace, the message originated at: [61.15.23.248],
[61.15.23.248] helo=myndlab61

Return-Path: <payslip@example.com>
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Message-ID: <00c401c9b831$e8d262a0$aa01a8c0@myndlab61>
Subject: Fw: SALARY SLIP
The message has been quarantined as: virus-ITe5W1RqeS4k

Notification to sender will not be mailed.

The message WAS NOT relayed to:
<pradeepan@ozonegp.com>:
250 2.7.0 Ok, discarded, id=02622-06 - VIRUS: Encrypted.Zip, Encrypted.Zip

Virus scanner output:
p005: Encrypted.Zip FOUND
p002: Encrypted.Zip FOUND

################################################## ###################

getting below logs :


Apr 8 15:38:15 mail amavis[2622]: (02622-06) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20090408T151902-02622: <payslip@example.com> -> <abc@domain.com> SIZE=79075 Received: from mail ([127.0.0.1]) by localhost (mail [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <abc@domain.com>; Wed, 8 Apr 2009 15:38:15 +0530 (IST)
Apr 8 15:38:15 mail amavis[2622]: (02622-06) Checking: ITe5W1RqeS4k [64.22.105.30] <payslip@example.com> -> <abc@mydomain.com>
Apr 8 15:38:17 mail amavis[2622]: (02622-06) Blocked INFECTED (Encrypted.Zip), [64.12.10.30] [61.15.23.248] <abc@example.com> -> <abc@mydomain.com>, quarantine: virus-ITe5W1RqeS4k, Message-ID: <00c401c9b831$e8d262a0$aa01a8c0@myndlab61>, mail_id: ITe5W1RqeS4k, Hits: -, size: 79075, 2323 ms


######################################

pls suggest...client is very upset..how can i fix this issue..

Thanks

[phoenix]

Do not post duplicate messages on the same topic in the forums.

[uxbod]

Have you read the documentation specifically the section Anti-virus settings ?

[chandu]

thanks for reply uxbod...yeap i have already checked this setting...actually i found that they were sending payslip in zip file and in error it was showing blocked encrypted zip files...and i found tht i have enabled "blocked encrypted archives" option...so just uncheck that..and restart the service...so lets see...i havent recevie any update yet from their end...

thanks