order of scans and rulesets

[Julian Field]

At 12:26 22/01/2003, you wrote:
>One more question if I may. I see from mailscanner.conf that we can use a
>ruleset for this Silent Viruses feature. Would the syntax of the file just
>be a list of virus names, one per line?
>
>i.e.:
>Yaha-K
>Avril-A
>Avril-B
>Hybris-B

No, it is just a space separated list of virus names.

>Regarding these ruleset files, I am not 100% sure whther I can just use a
>series of domains, names, etc or whether I need a full rule. For example
>for a spam.blacklist.rules file, do I need
>
>FromTo: default         no
>From:   big at boss.com    yes
>To:     user_a at server.co.uk   yes
>
>or just the following would be enough:
>
>big at boss.com
>user_a at server.co.uk

You need to use proper rules.



>Thanks in advance,
>
>Sylvain
>
>
> >>> paul_houselander at BRISTOL-LEA.ORG.UK 21/01/2003 16:29:46 >>>
>Take a look at
>
>Silent Viruses =
>Still Deliver Silent Viruses =
>
>mailscanner.conf
>
>As pet the comments in mailscanner.conf
>
>"# Strings listed here will be searched for in the output of the virus
>scanners."
>
>So check what your virus scanner outputs and put the string in Silent
>Viruses
>
>Cheers
>
>Paul
>----- Original Message -----
>From: "Sylvain Phaneuf" <sylvain.phaneuf at IMSU.OXFORD.AC.UK>
>To: <MAILSCANNER at JISCMAIL.AC.UK>
>Sent: Tuesday, January 21, 2003 4:18 PM
>Subject: Re: order of scans
>
>
> > That sounds promising...  looking forward to hear from Julian...
> >
> > >>> RHerban at GRAMTEL.NET 21/01/2003 16:08:43 >>>
> > There is an option in the MailScanner.conf about silent viruses.  You
>should
> > be able to enter snowwhite or something like into that option and it won't
> > deliver a notice about it.
> > I'm not sure what method Julian is using to get the name of the virus so I
> > can't say how to go about getting that.
> >
> > Randy
> >
> > -----Original Message-----
> > From: Sylvain Phaneuf [mailto:sylvain.phaneuf at IMSU.OXFORD.AC.UK]
> > Sent: Tuesday, January 21, 2003 11:02 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: order of scans
> >
> >
> > I am still a newbie here, and I would like to apologise in advance if this
> > has been covered somewhere.
> >
> > Is there a way to organise the order in which the various scans occur on
>the
> > system (MailSvanner/SpamAssassin on RedHat)
> >
> > I would like to reduce the number of notifications that some of our users
> > get. For example we have a few users being pestered with the Snowhite and
> > seven dwarf message, which is a virus, and the attachement is an exe file.
> > We do not want to pass on this message, but because we have notifications
>on
> > for both infected messages and blocked files, the end user still receives
>a
> > message when the Snowhite message arrive. If there is a way MailScanner
> > could be configured so that this kind of message do produce any
> > notifications, some of our users would be quite happy,
> >
> > Thanks in advance,
> >
> >
> > Sylvain
> >
> > ===========================================================
> > Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
> > Information Management Services Unit   (Clinical School)
> > Oxford University                               | email :
> > sylvain.phaneuf at imsu.ox.ac.uk
> > Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
> > Oxford   OX3 9DU   England
> > ===========================================================
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support