Don't Quarantine Viruses

Julian Field mailscanner at ecs.soton.ac.uk
Fri Jan 30 09:26:18 GMT 2004


The test is a simple sub-string, so "mydoom" should match both of your
examples.

At 22:32 29/01/2004, you wrote:
>Do these names have to match the name as reported by the virus scanners?
>or is it case insensitive?
>
>i.e., will:
>
>Virus:   mydoom    no
>
>prevent mydoom from being quarantined when caught by either sophossavi
>or uvscan?
>
>or do I need to do this? :
>
>Virus:   W32/MyDoom-A      no
>Virus:   W32/Mydoom.a at MM   no
>
>
>Thanks,
>Eric Rz.
>
>On Wed, Jan 28, 2004 at 02:55:11PM -0500, Hirsh, Joshua wrote:
> > > I'd like to be able to not quarantine viruses but still
> > > quarantine filetype denies.
> >
> > Yup, you can distinguish between the two. You can set "Quarantine
> > Infections" to match against a rule, and in the rules file have something
> > like this:
> >
> > Virus:  sobig           no
> > Virus:  dumaru  no
> > Virus:  mimail  no
> >
> >
> > Etc..
> >
> >
> >  Cheers,
> >
> > -Joshua

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654



More information about the MailScanner mailing list