virus scanning quarantine spam (MailScanner ANNOUNCE 4.37.2)

[Chuck Foster]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


Hi,

I took a quick look at this, but I'm not sure how it does it in the code?
I can see a $VirusBeforeSpamMCP variable being set in the MailScanner
binary, but couldn't see where it actually gets used so that
RemoveInfectedSpam() does something useful.

Probably just a Monday morning thing!


The way I'd originally envisaged resolving this pre-this-release was to
look at swapping over the AV and AS calls, on the basis that if something
is flagged as a virus people aren't really going to care that it is spam
as well ... we're working in a situation where customers may want to
quarantine spam messages or not, and I couldn't really see the point of
virus-scanning something that is to be thrown away, but also didn't want
it stored without being checked. Your method probably sorts that dilemma
out, though a ruleset to determine whether to remove the infected message
or not would be useful!

Best Wishes,
Chuck

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of Julian Field
Sent: 12 December 2004 16:46
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: MailScanner ANNOUNCE 4.37.2


I have just released beta version 4.37.2.

The main new feature is one that some of you have been waiting for a
long time, and I hope I have come up with a resonable solution to the
problem you were hitting, while not solving it the way you suggested
(bit of lateral thinking went on here :-)

If you quarantine spam, you end up with the quarantine containing
virus-infected spam as well.
Bad news if you want to give your users access to be able to retrieve
messages from the quarantine. They can retrieve viruses as well.

There is a new option:
    Keep Spam And MCP Archive Clean
If you set this to yes, then all spam will be virus-scanned, and removed
from the quarantine if it was found to be infected in any way. This way,
your users can't infect themselves.

I hope this is to your liking, it's not the most elegant implementation,
but doing it elegantly was such a big job it was never going to happen.
Please let me know what you think.



This message should be regarded as confidential. If you have received
this
email in error please notify the sender and destroy it immediately.
Statements of intent shall only become binding when confirmed in hard
copy
by an authorized signatory.
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!