Dont send virus alerts, but DO send bad file name/type etc.

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

James Gray wrote:

>Hi All,
>
>Our site is being hammered with Sober.j and Netsky.p (mostly) to the tune of
>several hundred an hour at times.  Understandably, users are getting a little
>peeved at the amount "[** VIRUS **]" alerts they're getting.  I've hinted to
>the powers that be, there may be a way to dump virus alerts, but still send
>notices to users about bad filenames and bad filetypes.  Spam will be handled
>by attaching the original (action=attachment deliver).
>
>So the actions would be:
>Virus = delete, don't send notice to user, notify admin.
>
>
Silent Viruses = All-Viruses
Still Deliver Silent Viruses = no

>Bad Filname = quarantine, notify user, notify admin.
>Bad Filetype = quarantine, notify user, notify admin.
>Spam = deliver as attachment (actually these are handled by a bunch of
>rulesets to enable per-user hi/lo spam thresholds and spam actions, but the
>default is "deliver attachment")
>
>So does anyone know the magic combination of options in mailscanner.conf to
>achieve what I'm trying to do??  I've RTFMAQ, and FAQ and the archives, and
>the conf file, but haven't found anything _exactly_ what I'm after.  Feel
>free to beat beat me with a clue bat if I've missed something.
>
>Thanks in advance.  BTW - thanks to Julian for saving our Windows users from
>themselves :P  Have to admit how smug I felt during that in-between period of
>virus outbreak and signature update, where MailScanner dutifully quarantined
>all the nasty attachments even though NAI-VirusScan didn't detect them :)
>
>
Handy, isn't it!

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!