I needed to disable blocking of encrypted archives, since we get invoices from our mobile phone company as encrypted .zips (is it possible to whitelist virus checking based on e-mail address? I only found this setting for spam).

Anyways, after much googling, I found a page, that plainly states, that this option is turned on by default. I commented on talk page for this to include exact command, how to turn it off:

Talk:Zimbra MTA - ZimbraWiki

I found, that

zmprov mcf zimbraVirusBlockEncryptedArchive FALSE

Changes this setting. I found it when I found /opt/zimbra/conf/clamd.conf.in, especially these lines:

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: disabled
%%comment VAR:!zimbraVirusBlockEncryptedArchive%%ArchiveBloc kEncrypted yes

Anyways, I don't know when clamd.conf (which is used) is regenerated. I
restarted Zimbra using /etc/init.d/zimbra restart, which does zmcontrol shutdown and zmcontrol start as user zimbra.

clamd.conf was still not regenerated, even when I did zmclamdctl stop ;
zmclamdctl start.

So I changed it in clamd.conf. Anyways, I would still like to know how are the config files regenerated.