Hi all,
in response to recent wave of viruses that were not detected by any antivirus,
we decided to simply block any nested zip files. (Exe inside Zip inside Zip).
So I tried to set MaxRecursion=1, just to find out that it passes such files
as clean without scanning deeper. I want to block such files in the same
manner as encrypted archives, but the ArchiveBlockMax option is obsolete. Why?
Is there any undocumented replacement option for that?
On some man pages I found --max-block, but that is ignored as well.
Is there any reason to drop such function?
--
Best Regards
Vladislav Kurz
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
