ESET - error - password-protected file

[jonathanm]

Good Day

We are using ProxMox Mail Gateway with ESET, however, we are having an issues with password protected files, like bank statements been are blocked under Virus Quarantine.

Under /usr/local/bin/pmg-custom-check the following is set:

## block passwd-protected / damaged archive ?
my $strict = 0;
mkdir $debug_dir;
my $cmd;

while ( defined( my $line = <$cmd> ) ) {
chomp $line;

print $logger "DEBUG:" . $line, "\n" if ( $debug > 0 );
$line =~ s/result=/threat=/g if ( $av_version eq "7.X" );
if ( $line =~ m/^name=\"(.*)\".*threat=\"(.*)\".*action=\"(.*)\".*info=\"(.*)\"$/ ) {
next if ( ( $strict < 1 ) && ( $4 =~ m/password-protected/g || $4 =~ m/archive damaged/g ) );
$vinfo = "VIRUS: " . $2 . " " . $4 . "($av_name)";
next if $2;

print $logger "DEBUG: " . $vinfo, "\n" if ( $debug > 0 );
}
}


We are running ESET Server Security for Linux, Version 9.0

I would appreciate any help
Thanks

 

[Stoiko Ivanov]

I don't have any experience with ESET - so probably can only be of limited help - but - did you check what the actual output of the eset-scanner is when it sees such a file?

maybe you need to adapt the regex matching for 'password-protected' or 'archive damaged'