Blocking attachments instead of just removing them

[Julian Field]

At 14:51 28/08/2003, you wrote:
>Ya, but then that won't deliever any legitimate e-mails with .doc files
>that may have had a simple macro that could have been removed.

No, if there is a macro virus that could be removed, then it will be
delivered if
Deliver Disinfected Files = yes
after it has been disinfected from the doc file.


>   That is why
>I suggested a way to completely stop messages (nothing sent to intended
>recipient or sender) with some types of files
>(.scr, .pif, .bat, .vbs, .etc) since those messages most likely contain no
>legitimate contenat, only the virus itself AND to clean and send on others
>(such as .doc files).
>
>I don't see that this is currently possibly.
>
>At 14:40 28/08/2003, you wrote:
> >But when it removes the attachments listed in that file, doesn't it
> >then send on the rest of the message to the intended recipient?  That
> >is what I am hoping to stop.
>
>In which case,
>Deliver Cleaned Messages = no
>
>
>
> >At 13:58 28/08/2003, you wrote:
> > >A suggestion for future versions.  Would it be possible to create a
> > >separate, new setting that allows you to block a list of given
> > >attachments?  I feel like with the latest round of viruses, many
> > >would find that feature useful.  That way, if I run MailScanner along
> > >with a virus scanner and tell it that any e-mail it finds with a
> > >.scr, .pif, .bat, .exe, .vbs, can simply be delted without
> > >notification to the sender.  Any other viruses found (such as a macro
> > >virus in a Word
> > >document) would be cleaned and sent on.  I have seen several of these
> > >macro viruses still floating around.
> >
> >Already there. See /etc/MailScanner/filename.rules.conf.
> >
> >To get the fine-grained "sender notification" control, I implemented
> >that a day or two ago for someone else, and it is in the beta release I
> >have just published.
> >
> > >By the way, thank you very much for all the responses.  I'm sold on
> > >the product, but I sure wish it had the feature above.
> >
> >It already has :-)
> >
> >
> >
> > >At 23:06 27/08/2003, you wrote:
> > > >I was planning on implementing virus scanning with MailScanner in
> > > >the near future (I probably should have mentioned that).  If I set
> > > >Deliver Cleaned Messages = no , won't it also block any messages
> > > >that contain viruses that have been successfully cleaned?
> > >
> > >Yes, but that forms a very small %-age of total infected mail these
> > >days, so I wouldn't worry about it too much.
> > >
> > > >   Also, will that setting effect spam
> > > >messages?
> > >
> > >Only infected spam.
> > >
> > >
> > > >At 21:39 27/08/2003, you wrote:
> > > > >I am new to MailScanner, however I must say I am very impressed
> > > > >so far. I am attempting to block all e-mail messages with certain
> > > > >attachments (.scr, .pif, etc . . .) as I'm sure many admins are
> > > > >right now.  I have figured out how to remove those attachments
> > > > >and then insert a message in the body and send it on to the
> > > > >intended recipient but I would like to stop the messages with
> > > > >these attachments all together.  Note I am not running
> > > > >MailScanner with any antivirus (I already had a gateway antivirus
> > > > >running on another machine).
> > > >
> > > >Deliver Cleaned Messages = no
> > > >
> > > >
> > > > >Thank you very much in advance.
> > > > >
> > > > >lists at trcintl.com
> > > >
> > > >--
> > > >Julian Field
> > > >www.MailScanner.info
> > > >Professional Support Services at www.MailScanner.biz MailScanner
> > > >thanks transtec Computers for their support
> > >
> > >--
> > >Julian Field
> > >www.MailScanner.info
> > >MailScanner thanks transtec Computers for their support
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support