How to bypass vulnerability scanning in Declude
A vulnerability is a method that people can use to bypass virus scanning. Declude EVA will catch all vulnerabilities as if they were viruses. At times, a good message will be caught. There are a few ways to allow vulnerabilities to be sent/received through your server. If a message is caught by Declude's vulnerability scanning, you will see a line such as the following in the header of the message and your Declude log (if in DEBUG mode):
Declude Virus v4.12.11 caught the [Outlook 'CR' Vulnerability] virus in [No attachment]
There are 3 ways to resolve this.
Option 1:
Open your virus.cfg file which is located in your Declude directory. Find the following line and remove the # from in front of it: #ALLOWVULNERABILITY OLCR
This will allow all messages with this vulnerability to come through for all users on your server.
Option 2:
Open your virus.cfg file and find the following example line:
#ALLOWVULNERABILITIESTO webmaster-vir@declude.com
Under that line, add the following line:
ALLOWVULNERABILITIESTO youruser@domain.com
This will allow all messages with any vulnerability to come through when sent to youruser@domain.com.
Option 3:
Open your virus.cfg file and find the following example line:
#ALLOWVULNERABILITIESFROM webmaster-vir@declude.com
Under that line, add the following line:
ALLOWVULNERABILITIESFROM sender@domain.com
This will allow all messages with any vulnerability to come through when sent from sender@domain.com.
To release caught vulnerabilities, go to your \Spool\Virus directory. Copy the file pair and drop them in \Spool for delivery.