Whoa!! "Virus Scan failed" What?

[Julian Field]

At 19:01 11/09/2003, you wrote:
>On Thu, 2003-09-11 at 18:34, Jeff A. Earickson wrote:
>
> >Sep 11 12:40:07 basalt <22>MailScanner[17224]: ERROR:: Virus scan
> >failed
> >(514):: ./h8BGdlAn026143/.pdf
>
>This has been discussed in the last few days, there are certain pdfs
>Sophos has problems with.
>
> >Whoa...  The virus scan failed, so the email got delivered?  This seems
> >like a Bad Thing (tm).
>
>It might also seem like a bad thing if a regular update screwed your
>scanner and so all mail was rejected?
>You're running clam too, which presumably didn't fail and returned a
>clean result?  I think the answer is to run multiple scanners, but I'd
>be interested in knowing the logic here.  We know that any scanner finds
>a virus the mail is 'infected', but presumably if one fails to scan but
>the other one doesn't find anything it assumes clean?  That seems
>sensible to me.

Given all the above, what would you like it to do? At the moment it logs
the fact that something nasty happened, but doesn't actually remove the
file from the message. I guess you would like it to be removed, am I
correct? The snag is that with SophosSAVI you can't specify the "allowed
error messages" so all files it didn't like (such as quite a lot of
non-Acrobat-generated PDF files) would always get trapped.

Let me know your thoughts...
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support