Hi, >> Is there any ability to determine if a particular attachment has a >> Word macro enclosed in addition to just having a Word document? > > that's the hob of clamav and the sa-plugin for it > > "OLE2BlockMacros yes" in case of a scored SA plugin won't block but add the > score of that clamd-instance, for unconditional block of other things you > typically have a calmd-instance with different config running as > unconditional milter
Yeah, that's unacceptable to me. I can't accept obscuring whether a particular attachment has a macro virus and instead just be notified only that it has a macro. That's effectively saying it's necessary to outright block all macros or risk allowing attachments with macro viruses to be passed unencumbered. I was looking for another way to link macros with spamassassin, as the amavisd/clamd approach is broken.
