Virii, bad file names, and quarantine in V4

[Julian Field]

At 23:59 22/09/2002, you wrote:
>It looks like something isn't working the way I'd think it should. With
>"Quarantine Infections = no" I'm seeing those things that violate the
>Outlook security check and infected attachments being quarantined.

Thanks for spotting that. Fixed.

>What I'd like to be able to do is to cause those attachments identified
>as a virus by the virus scanner simply be deleted and things that
>violate the file name rules be quarantined. According to the conf file
>it would seen that this should be possible via a ruleset, but I haven't
>a clue as to what that ruleset would look like (and yeah, I've looked at
>the rules/README & rules/EXAMPLES)

You currently can't do this. I would be very tempted to say that you should
scan anything in the quarantine before giving it out to users anyway, just
to be on the safe side.

What does anyone else think?

>There's no way that I ever want to give a user a file out of the
>quarantine area that is known to be infected, but they may have a valid
>use for files that fail the file name check. Short of virus scanning
>everything in the quarantine dir I don't see how I'd know which was
>which.

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ