Block encrypted archives (kav)

[gustavmuenster]

Hello

We have activated today the kav license.

We have used with CLAMAV the option "Block encrypted archives" to filter out all emails with password protected ZIP Files.

But with kaspersky, this option will filter out many emails with no attachments! It has filtered simple text mails with the remark:
virus detected: Encrypted-Content (kav)

How can I disable this option only for kaspersky?

Thanks.

Regards.

Gustav

 

[tom]

Hello

We have activated today the kav license.

We have used with CLAMAV the option "Block encrypted archives" to filter out all emails with password protected ZIP Files.

But with kaspersky, this option will filter out many emails with no attachments! It has filtered simple text mails with the remark:
virus detected: Encrypted-Content (kav)

How can I disable this option only for kaspersky?

Thanks.

Regards.

Gustav

hi,
please disable "block encrypted archives", we are looking into this issue and I will come back to you as soon as possible.

 

[tom]

Hello

We have activated today the kav license.

We have used with CLAMAV the option "Block encrypted archives" to filter out all emails with password protected ZIP Files.

But with kaspersky, this option will filter out many emails with no attachments! It has filtered simple text mails with the remark:
virus detected: Encrypted-Content (kav)

How can I disable this option only for kaspersky?

Thanks.

Regards.

Gustav

Hi Gustav,
we have a hotfix addressing this issue, if you want it just email to support@proxmox.com.

we plan to release a global hotfix in the next weeks which will include this and other fixes as well.

 

[gustavmuenster]

Hello.

Thanks. The Patch is working.

Has Proxmox also the possibility to add a "what" object, that will be a
"Mail with Encrypted-Content", to allow only for a group of persons to send and receive encrypted-Zip files.

Thanks.

Regards.

Gustav.

 

[tom]

Hello.

Thanks. The Patch is working.

Has Proxmox also the possibility to add a "what" object, that will be a
"Mail with Encrypted-Content", to allow only for a group of persons to send and receive encrypted-Zip files.

Thanks.

Regards.

Gustav.

Hi Gustav,

thanks for the update.

there exists no WHAT object addressing encrypted zip files, as this is not a standard in terms of a mime types. (zip and encrypted zip files are the same mime type)

if you need encrypted archives, please use PGP or S/MIME, which is a "real" encryption. and for these mime types you can define WHAT objects.

 

[gustavmuenster]

Hello

If the kav antivirus detect an "virus detected: Encrypted-Content", then this event must i allow for a group of users.

I have only found the option to disable it for all users. But that is not what we need.

If you can add (in a future version) a "what" option, that include the virus name, so we can create a rule to allow the "encryptetd-Content".

Thanks.

Regards.

Gustav.

 

[tom]

Hello.

Thanks. The Patch is working.

Has Proxmox also the possibility to add a "what" object, that will be a
"Mail with Encrypted-Content", to allow only for a group of persons to send and receive encrypted-Zip files.

Thanks.

Regards.

Gustav.

Hi Gustav,
Please apply also the hotfix 2123 to your Proxmox (include the latest clamav)