Note that you can list a password-protected zip file without knowing the password, which will allow you to ban zip files containing executables.

I'm worried about the attachments+stupidity arms race. Might have to ban executables altogether, or just put in a forced delay of a day so that there's time for the AV software to catch up :-)

Note that you can list a password-protected zip file without knowing the password, which will allow you to ban zip files containing executables.

James and I think this is the best solution anyone has suggested, so we're now doing that and it seems to be working so far. Thanks :-)