worm emails marked as possible spam

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

IT Dept spake the following on 12/1/2005 12:34 PM:
> IT Dept wrote:
> 
>> Jeff,
>>
>> I agree. This seems like EXACTLY what's happening. I haven't been over
>> on the clamav list lately...what are people saying there about this
>> issue?
>>
>> Cheers,
>> Chris
> 
> 
> Hi Jeff and all,
> 
> I take back what I said. I have checked by logging in via ssh and
> visiting the message quarantine dir and typing "clamscan *" and it does
> indeed find Sober.U.
> 
> So, back to MailScanner then...Why, if a message is not being tagged as
> "high spam" would the message appear to not be scanned for viruses? What
> happens first, a blocked file or the virus scan? My guess is that
> because the file is blocked (we don't allow .exe files ever),
> MailScanner is not sending the file to be scanned for viruses; as a
> result my users are being deluged with bad content messages...sometimes
> over a hundred a day. Is there a way to change this, other than allowing
> .exe files?
> 
> Thanks,
> Chris
> 
AFAICR I think they are spam checked, virus scanned, and then run
through filename/type checks.
Maybe there is something in your silent viruses config missing like "all
viruses".


-- 

/-----------------------\           |~~\_____/~~\__  |
| MailScanner; The best |___________ \N1____====== )-+
| protection on the net!|                   ~~~|/~~  |
\-----------------------/                      ()

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!