order of scans and rulesets

[Sylvain Phaneuf]

One more question if I may. I see from mailscanner.conf that we can use a ruleset for this Silent Viruses feature. Would the syntax of the file just be a list of virus names, one per line?

i.e.:
Yaha-K
Avril-A
Avril-B
Hybris-B

Regarding these ruleset files, I am not 100% sure whther I can just use a series of domains, names, etc or whether I need a full rule. For example for a spam.blacklist.rules file, do I need 

FromTo: default         no
From:   big at boss.com    yes
To:     user_a at server.co.uk   yes

or just the following would be enough:

big at boss.com
user_a at server.co.uk


Thanks in advance,

Sylvain


>>> paul_houselander at BRISTOL-LEA.ORG.UK 21/01/2003 16:29:46 >>>
Take a look at

Silent Viruses =
Still Deliver Silent Viruses =

mailscanner.conf

As pet the comments in mailscanner.conf

"# Strings listed here will be searched for in the output of the virus
scanners."

So check what your virus scanner outputs and put the string in Silent
Viruses

Cheers

Paul
----- Original Message -----
From: "Sylvain Phaneuf" <sylvain.phaneuf at IMSU.OXFORD.AC.UK>
To: <MAILSCANNER at JISCMAIL.AC.UK>
Sent: Tuesday, January 21, 2003 4:18 PM
Subject: Re: order of scans


> That sounds promising...  looking forward to hear from Julian...
>
> >>> RHerban at GRAMTEL.NET 21/01/2003 16:08:43 >>>
> There is an option in the MailScanner.conf about silent viruses.  You
should
> be able to enter snowwhite or something like into that option and it won't
> deliver a notice about it.
> I'm not sure what method Julian is using to get the name of the virus so I
> can't say how to go about getting that.
>
> Randy
>
> -----Original Message-----
> From: Sylvain Phaneuf [mailto:sylvain.phaneuf at IMSU.OXFORD.AC.UK] 
> Sent: Tuesday, January 21, 2003 11:02 AM
> To: MAILSCANNER at JISCMAIL.AC.UK 
> Subject: order of scans
>
>
> I am still a newbie here, and I would like to apologise in advance if this
> has been covered somewhere.
>
> Is there a way to organise the order in which the various scans occur on
the
> system (MailSvanner/SpamAssassin on RedHat)
>
> I would like to reduce the number of notifications that some of our users
> get. For example we have a few users being pestered with the Snowhite and
> seven dwarf message, which is a virus, and the attachement is an exe file.
> We do not want to pass on this message, but because we have notifications
on
> for both infected messages and blocked files, the end user still receives
a
> message when the Snowhite message arrive. If there is a way MailScanner
> could be configured so that this kind of message do produce any
> notifications, some of our users would be quite happy,
>
> Thanks in advance,
>
>
> Sylvain
>
> ===========================================================
> Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
> Information Management Services Unit   (Clinical School)
> Oxford University                               | email :
> sylvain.phaneuf at imsu.ox.ac.uk 
> Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.