Problems with Silent Viruses

Julian Field mailscanner at ecs.soton.ac.uk
Wed Oct 27 18:10:52 IST 2004


    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Virtually all viruses forge the sender so whatever you do, don't notify
senders about viruses. Please!
All you really need to do is set
    Silent Viruses = All-Viruses
    Still Deliver Silent Viruses = no
That is by far the most sensible setup. If you still want to notify for
a few particular viruses such as macro viruses which don't forge the
sender address, take a look at Non-Forging Viruses.

Ray Dermody wrote:

>Hi,
>
>Im trying to get MailScanner to drop (discard) email with infections. e.g
>not to notify sender or recipient. Notably Netsky and Bagle.
>Looking down through the documentation I conclude incorrectly that
>this should work in my MailScanner.conf file
>
>Silent Viruses = /etc/MailScanner/viruses.to.delete.conf
>Still Deliver Silent Viruses = no
>
>And my viruses.to.delete.conf file has these entries for example
>W32/Klez.gen at MM
>W32/Sobig.f at MM
>W32/Dumaru.a at MM
>W32/Bagle at MM
>W32/Bagle.ai at MM
>W32/Bagle.aa at MM
>W32/Netsky.p at MM
>W32/Netsky.z at MM
>W32/Netsky.d at MM
>
>Any ideas why the recipient is still getting notified that a virus was being
>sent to them?
>Any help would be greatly appreciated.
>
>Ray.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).




More information about the MailScanner mailing list