On 11/04/2013 04:58 PM, Nicholas Chua wrote: > <snip> >>> We block lots of virus-prone attachments using entries in >>> /var/qmail/control/simcontrol: >>> - executables (.exe, .js, .bat, etc.) >>> - office docs (.doc, .docx, .pdf, etc.) >>> - archive files (.zip, .rar, .7z, etc.) >>> >>> If you're seeing emails come in with links that download viruses, you >>> can write SpamAssassin rules to block these, but it quickly becomes a >>> game of whack-a-mole. > Most of the virus are compressed with zip and rar which i am unable to block > as most of the users are sending these files. > For spamassassin i am using KAM which is kinda effective. > > Maybe someone out there has clamav + sophie + simscan running which might > strengthen the virus protection part? > > Regards > nic > You might take a look at the SaneSecurity Foxhole signatures for ClamAV:
http://sanesecurity.com/foxhole-databases/ These are designed to hit on any executable in an archive file. Regards, Brent Gardner --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
