Sophos thinks multi-part spanning zips are viruses

[James Corell]

Actually, I'd like MailScanner not to consider an attachment a virus unless
Sophos CONFIRMS that it is actually a virus (rather than simply failing to
be able to scan it).

James Corell
E-P-C-S
111 West Mitchell, Suite E
Gaylord, MI 49735
(989) 732-1366

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of Julian Field
Sent: Tuesday, March 09, 2004 3:27 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Sophos thinks multi-part spanning zips are
viruses


At 19:52 09/03/2004, you wrote:
>Has anyone seen this error?
>
> >>> BEGIN
>
>The original attachment to this e-mail message (BACKUP.ZIP) contained a
>virus
>and has been removed.
>
>    Tue Mar  9 14:17:14 2004 the virus scanner said:
>    Sophos: Could not check BACKUP.ZIP/TURBO.MDB (part of multi volume
>archive)
>    Sophos: Could not check BACKUP.ZIP (part of multi volume archive)
>
> >>> END
>
>Is this something Sophos needs to address, or is there something
MailScanner
>can do about it? I'd like to let my customers pass these kinds of zips
>through the server, while leaving normal virus scanning intact.
>
>Maybe Julian knows: Does Sophos pass back only one kind of error code, or
>does MailScanner assume any error code from a scanner is a detected virus?
>Are error codes used at all or is STDERR text used instead?

The output text is used, not the error codes. Would you like me to ban
parts of multi-volume archives?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654