[Declude.Virus] Declude is blocking password protected excel files

[Dave Czoper]

Hi, I running declude virus Ver.1.178i9 and I'm using Sophos anti virus. In the virus.cfg I have a virus code 2 under sophos but when someone is sending a xls file with a password on it I get this error in the virus log below.

 

03/10/2004 15:02:03 Q743829a501eaae18 Could not find parse string >>> Virus in report.txt
03/10/2004 15:02:03 Q743829a501eaae18 File(s) are INFECTED [: 2]
03/10/2004 15:02:03 Q743829a501eaae18 Scanned: CONTAINS A VIRUS [MIME: 3 20071]

 

Now if I take out the virus code 2 the email goes through fine but declude or sophos is not detecting the eicarencodedzip and eicardynamicencodedzip virus test. What can I do?  Below is part of my virus.cfg.

 

SCANFILE        C:\Progra~1\Sophos~2\sav32cli.exe -ns -p=report.txt -mac -archive
VIRUSCODE       3
VIRUSCODE       6
VIRUSCODE       2
REPORT          >>> Virus

 

#
# The SKIPEXT option will let you skip scanning of certain file extensions.  For
# example, a GIF file can't contain a virus, so there is no need to scan it.
#

 

SKIPEXT         GIF
SKIPEXT         JPG
SKIPEXT         MPG
SKIPEXT         PNG

 

#
# The BANEXT option will let you ban file extensions.  E-mails containing attachments
# with these file extensions will be quarantined, and if you have a BANnotify.EML file,
# it will be sent out.  This works in the Standard and Pro versions.
#

 

BANEXT          SCR
BANEXT          PIF
BANEXT          CMD
BANEXT          BAT
BANEXT          EXE

 

Dave Czoper

 

PERT Survey Research

Network Administrator

2247 Babcock Blvd

Pittsburgh, PA 15237

412-939-1500