Whoa!! "Virus Scan failed" What?

[Antony Stone]

On Thursday 11 September 2003 10:57 pm, Nerijus Baliunas wrote:

> On Thu, 11 Sep 2003 19:01:27 +0100 Kevin Spicer <kevins at BMRB.CO.UK> wrote:
> > >Whoa...  The virus scan failed, so the email got delivered?  This seems
> > >like a Bad Thing (tm).
> >
> > It might also seem like a bad thing if a regular update screwed your
> > scanner and so all mail was rejected?
>
> IMHO we need an option for that - I don't like to deliver mail when virus
> scanning fails, but others might.

I think it's worth remembering that virus scanners don't *guarantee* to
identify viruses anyway, so even if scanning was successful, and the scanner
says "nothing found", it just might still not be safe to deliver the email.

You can be pretty sure that if your virus scanner says "I found virus XYZ",
then you've got an infected file which shouldn't be delivered.

But if the virus scanner says "I didn't find anything" (or if it was
unsuccessful in attempting the scan) then you still can't be completely sure
either way - it might be a virus, it might not.   There's no way to say for
certain "this is *not* a virus".

I think the "unsuccessful scan" situation ought to be treated just the same
as a virus scanner saying "I didn't find anything to report" - there's no
reason to treat the file being scanned as infected unless another virus
scanner says "I found something".

If you get too high a proportion of files which your virus scanner can't
scan, then that's a reason to change (or supplement) your virus scanner, not
a reason to change MailScanner.

In any case, your filename extension rules should be taking care of any files
which unsuspecting users might open inadvertently - that's how several people
on this list (includng myself) first started picking up Sobig.F before we had
anti-virus signatures for it.

Regards,

Antony.

--

This is not a rehearsal.
This is Real Life.