Scan Virus and delete it in this moment ??

[Ugo Bellavance]

Diego Fabara wrote:

> I've a lot of mails in quarantine.
>  
> 1. Virus files reported by Clamav 
> 2. Attachments files stopped by Filenames rules..
> Then I'd like to check it and try first to disinfect this files  (1) and
> no delete others files (2) because would be false positive attachments.
> 
> My quarantine time is 45 days, and I have been checking all files into
> folder, to decide delete them or not manually.
> 
> How to do this automatically ??  
> 
>  
Hmmm, still a bit hard to understand (by the way, if you speak french 
(I'm not good enough in spanish to debug), e-mail me offlist.

But I think this might help you

# Should I attempt to disinfect infected attachments and then deliver
# the clean ones. "Disinfection" involves removing viruses from files
# (such as removing macro viruses from documents). "Cleaning" is the
# replacement of infected attachments with "VirusWarning.txt" text
# attachments.
# Less than 1% of viruses in the wild can be successfully disinfected,
# as macro viruses are now a rare occurrence. So the default has been
# changed to "no" as it gives a significant performance improvement.
#
# This can also be the filename of a ruleset.
Deliver Disinfected Files = yes

On the other hand, I really wonder why you'd like to do that­... I 
haven't see a virus that could be disinfected for ages.

Another option is to have notices sent

# Notify the local system administrators ("Notices To") when any infections
# are found?
# This can also be the filename of a ruleset.
Send Notices = yes

This way, if the volume is not too high, you can go through your 
messages once a day.

You could use MailWatch, as well, to visualise the messages.

Finally, maybe you could write a script that would parse the logfile for 
disinfection entries.

Hope this helps,

Ugo

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html