[Declude.Virus] Invalid file types triggering on an invalid file type

[Matt]

I found a message blocked for an "Invalid ZIP Vulnerability", but it doesn't have a zip attachment.  The only attachment on this message is a winmail.dat.  While that winmail.dat file clearly contains data of some sort, I am pretty certain that it is triggering vulnerabilities inappropriately, and I am positive that this message was not a virus. My Declude Virus logs are showing both the Invalid ZIP Vulnerability and a bogus .jpg file.  I would like to turn this detection off.  Is there a switch to turn off this detection? Detail follows: HEADERS FROM THE SINGLE ATTACHMENT ================================================================= ------=_NextPart_000_0056_01C6A9CF.4BDDA860 Content-Type: application/ms-tnef;     name="winmail.dat" Content-Transfer-Encoding: base64 Content-Disposition: attachment;     filename="winmail.dat" VIRUS LOG ENTRIES ================================================================= 07/17/2006 06:32:40.488 q674000a20000e465.smd Vulnerability flags = 862 07/17/2006 06:32:40.566 q674000a20000e465.smd MIME file: winmail.dat [base64; Length=2312012 Checksum=33270092] 07/17/2006 06:32:40.800 q674000a20000e465.smd Virus scanner 1 reports exit code of 0 07/17/2006 06:32:41.253 q674000a20000e465.smd Virus scanner 2 reports exit code of 0 07/17/2006 06:32:41.253 q674000a20000e465.smd Found a bogus .jpg file 07/17/2006 06:32:41.253 q674000a20000e465.smd Invalid ZIP Vulnerability 07/17/2006 06:32:41.253 q674000a20000e465.smd Found a bogus .Zip file 07/17/2006 06:32:41.253 q674000a20000e465.smd File(s) are INFECTED [[Invalid ZIP Vulnerability]: 0] 07/17/2006 06:32:41.253 q674000a20000e465.smd Scanned: CONTAINS A VIRUS [MIME: 7 2314810] 07/17/2006 06:32:41.269 q674000a20000e465.smd From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] [outgoing from ##.##.48.210] 07/17/2006 06:32:41.269 q674000a20000e465.smd Subject: FW: M341092022 / M341092023 Thanks, Matt --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.