Viruses tagged as spam

[Alex Neuman]

Point taken. I'll look into the archives to see if in fact it's been
explained once a month; I've been on the list for more than a month and
haven't run into any discussions or explanations on this. I admire his
patience as well; I also admire the patience of other list members who take
the time to answer questions and point to specific articles in the archives,
MAQ, FAQ, etc. even though the question has been asked a gazillion times
before instead of just saying "it's in the archives". I hope to one day be
proficient enough in the use, care and feeding of a MailScanner installation
to be able to help out in this list as others already have.

MailScanner has so far taken care of stopping viruses at my servers even
before virus signature updates are ready by having a specific set of
filename/content rules in place (like "no executables", etc.), and filtering
"bad" html. Don't see the need to mark it as spam and screw up your stats,
though.


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Peter Bonivart
Sent: Monday, April 12, 2004 11:35 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Viruses tagged as spam


Alex Neuman wrote:
> I seem to be getting a lot of viruses marked as high-scoring spam 
> lately. Seems most of them come from machines infected with the latest 
> netsky/bagle iterations, but get marked by DCC/Pyzor/etc. - could I be 
> doing something wrong? Does anybody else experience the same 
> situation?

Yes, it has saved me more than once when virus signatures were not yet
updated since I don't deliver high-scoring spam. It's a good thing.

> Second, since most spams are short, and most spam is stopped by most 
> postmasters by using RBL's (local, commercial or otherwise) at the 
> gateway MTA, could there be an option to virus scan first, and *then* 
> scan for spam? Spam scanning should be unnecessary if you *know* it's 
> a virus, right?

Please read the archives on this one. It has been discussed and explained by
Julian at least once a month for as long as I have subscribed to this list.
I admire his patience. ;-)

--
/Peter Bonivart

--Unix lovers do it in the Sun

Sun Fire V210, Solaris 9, Sendmail 8.12.10, MailScanner 4.29.7, SpamAssassin
2.63 + DCC 1.2.39, ClamAV 0.70RC + GMP 4.1.2, MailStats 0.25