.zip with pass problem ...

[aabreu2005]

Thanks for that.

Can you also take a look into /opt/zimbra/log/clamd.log ?

Thu Jul 5 15:55:58 2007 -> SelfCheck: Database status OK.
Thu Jul 5 16:05:59 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T155707-23928/parts/p003: Encrypted.Zip FOUND
Thu Jul 5 16:05:59 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T155707-23928/parts/p007: Encrypted.Zip FOUND
Thu Jul 5 16:15:50 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T161052-01561/parts/p003: Encrypted.Zip FOUND
Thu Jul 5 16:15:50 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T161052-01561/parts/p010: Encrypted.Zip FOUND
Thu Jul 5 16:20:24 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T161955-02336/parts/p003: Encrypted.Zip FOUND
Thu Jul 5 16:20:24 2007 -> /opt/zimbra/amavisd/tmp/amavis-20070705T161955-02336/parts/p007: Encrypted.Zip FOUND

[jholder]

hmmm - I don't know.
Are you sure there's not something in there?

Do you have admin alerts turned on for the virus notifications? if so, what does it say?

jh

[aabreu2005]

hmmm - I don't know.
Are you sure there's not something in there?

Do you have admin alerts turned on for the virus notifications? if so, what does it say?

jh

My users yes, admin users not ...

--------------------
VIRUS ALERT

Our content checker found
virus: Encrypted.Zip

in an email to you from unknown sender:
?@an-out-0708.google.com
claiming to be: <artur.abreu@xx.com>

Our internal reference code for your message is 02336-04/LSc9VVzFLweW

First upstream SMTP client IP address: [xxx.85.132.248] an-out-0708.google.com
According to a 'Received:' trace, the message originated at:
[209.85.132.248],

Return-Path: <artur.abreu@xx.com>
Message-ID: <eff7cfe40707051307q4c91941ao7aebafb59382cb87@mail .gmail.com>
Subject: teste
The message has been quarantined as: virus-LSc9VVzFLweW

Please contact your system administrator for details.

[aabreu2005]

help please ...

[jholder]

can you get that zip file to me somehow? yousendit.com works well

jholder@zimbra.com

or add me to your yahoo IM buddy list: wannabetenor@yahoo.com

[jholder]

Still trying to find the message. Our ZCS 5.0 Beta scanner killed it too.

Can you list the contents of this file please?

[aabreu2005]

Still trying to find the message. Our ZCS 5.0 Beta scanner killed it too.

Can you list the contents of this file please?

the last one is word…
Pass: 123

any archive .zip with password it refuses…

[technoteen]

i am also suffering from the same problem
i am using zimbra 4.5.6

the option for "block encrypted archives" is unchecked, it was earlier checked, still password protected zip files are being blocked

Output of : log/clamd.log

Mon Jul 9 21:34:53 2007 -> Log file size limited to 20971520 bytes.
Mon Jul 9 21:34:53 2007 -> Reading databases from /opt/zimbra/clamav/db
Mon Jul 9 21:35:09 2007 -> Loaded 136378 signatures.
Mon Jul 9 21:35:09 2007 -> Bound to tcp port 3310
Mon Jul 9 21:35:09 2007 -> Setting connection queue length to 15
Mon Jul 9 21:35:09 2007 -> Archive: Archived file size limit set to 104857600 bytes.
Mon Jul 9 21:35:09 2007 -> Archive: Recursion level limit set to 8.
Mon Jul 9 21:35:09 2007 -> Archive: Files limit set to 1000.
Mon Jul 9 21:35:09 2007 -> Archive: Compression ratio limit set to 250.
Mon Jul 9 21:35:09 2007 -> Archive support enabled.
Mon Jul 9 21:35:09 2007 -> Archive: Blocking encrypted archives.
Mon Jul 9 21:35:09 2007 -> Algorithmic detection enabled.
Mon Jul 9 21:35:09 2007 -> Portable Executable support enabled.
Mon Jul 9 21:35:09 2007 -> ELF support enabled.
Mon Jul 9 21:35:09 2007 -> Mail files support enabled.
Mon Jul 9 21:35:09 2007 -> Mail: Recursion level limit set to 64.
Mon Jul 9 21:35:09 2007 -> OLE2 support enabled.
Mon Jul 9 21:35:09 2007 -> PDF support disabled.
Mon Jul 9 21:35:09 2007 -> HTML support enabled.
Mon Jul 9 21:35:09 2007 -> Self checking every 1800 seconds.

clamd is still blocking archives as seen from the log. where does the problem lies??

[jholder]

Can someone get me a copy of the zip file?

[jholder]

Take a look in /opt/zimbra/conf/clamd.conf for the line:

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: disabled
%%comment VAR:!zimbraVirusBlockEncryptedArchive%%ArchiveBlockEncrypted yes

Does it say yes or no. If it says yes, try changing it to no.