Selectively quarantining on virus name

[Julian Field]

At 12:42 21/08/2003, you wrote:
> > -----Original Message-----
> > From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK]
> > Sent: 21 August 2003 12:32
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: Selectively quarantining on virus name
> >
> >
> > At 12:17 21/08/2003, you wrote:
> > > > At 17:49 20/08/2003, you wrote:
> > > > >        I presume that a rules file attached to the "Quarantine
> > > > >Infections" option uses the usual From or To type rules?
> > > >
> > > > Yes, just like any other ruleset.
> > >
> > >I have created a quarantine.rules file and in it I have placed:
> > >FromOrTo:       W32\/Sobig-F    no
> >
> > Eh? Rulesets test addresses, not virus names. "FromOrTo"
> > doesn't make much sense with a virus name, does it?
> >
> > You can't currently selectively not archive something because
> > of the particular virus in it.
>
>That's what I thought, I must have got confused with relation to
>your previous email :)
>
>Can it be a feature-request for a future version?

Not easy to do, as actually working out the exact name of the virus is not
easy. Yes, I know it appears that the "Silent Viruses" list appears to be
able to do it, but actually it cheats a bit. I could use the same cheat, I
guess.

Let me have a think about it. At the moment I don't have time to think, I'm
trying to keep up with the incoming mail load. I had a sandwich, a cup of
tea and a bottle of water for lunch. In the time it took me to eat those, I
received 88 new emails :-( Anyone want to swap email addresses with me for
the day?
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support