Transparently disinfecting attachments

[Julian Field]

At 21:38 17/12/2002, you wrote:
>* Julian Field (mailscanner at ECS.SOTON.AC.UK) wrote:
> > At 20:21 17/12/2002, you wrote:
> > >On Tue, 2002-12-17 at 18:47, Julian Field wrote:
> > > > At 17:15 17/12/2002, you wrote:
> > > > >I may be missing something obvious, but with MailScanner 4.10-1 and
> > > > >f-prot, is there any way to disinfect a file (e.g. a word
> document) and
> > > > >put it back into the email rather than emailing the disinfected one
> > > > >seperately?
> > > > >
> > > > >(hope I made enough sense then :)
> > > >
> > > > I intentionally didn't do this. I'm not sure entirely why, but I
> did have a
> > > > very good reason at the time. For one thing it makes management
> aware that
> > > > MailScanner has fixed the problem for them, and advertising gently
> to one's
> > > > PHBs is usually a good idea, makes them want to carry on paying you :-)
> > >
> > >Very true, but wouldn't adding in an extra attachment just before it do
> > >the job just as well? :)
> > >
> > >I have to admit that the current way works fine, but I'm planning on
> > >using it to virus scan email for customers, so transparent is good from
> > >that point of view (as long as you tell them that you did something
> > >obviously!)
> >
> > It's quite a major structural change in the code, so I'm a bit reluctant to
> > do it.
>
>If you disinfect the file, how are you 100% the virus scanner disinfected
>it?  I would say that if a file was flagged for a virus, I'm safer without
>that file.

I virus-scan the file, find the infection, then do a disinfection pass over
it, ignoring the results. I then do another virus-scan of it. It is only
deemed to be disinfected if it appeared in the first virus-scan and didn't
appear in the final one.

I don't assume the disinfection pass did anything useful.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


.



This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses
***********************************************************************************