Am 06.09.2016 um 22:40 schrieb Alex:
Is there any ability to determine if a particular attachment has a
Word macro enclosed in addition to just having a Word document?
that's the hob of clamav and the sa-plugin for it
"OLE2BlockMacros yes" in case of a scored SA plugin won't block but add the
score of that clamd-instance, for unconditional block of other things you
typically have a calmd-instance with different config running as
unconditional milter
Yeah, that's unacceptable to me.
I can't accept obscuring whether a particular attachment has a macro
virus and instead just be notified only that it has a macro. That's
effectively saying it's necessary to outright block all macros or risk
allowing attachments with macro viruses to be passed unencumbered
how is "has a Word macro enclosed in addition to just having a Word
document" different? it says nothing about virus or not and so
"OLE2BlockMacros yes" in context of scoring don't
