block msgs based on filename without using antivirus?

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You could use the "generic" virus scanner to do this. Read
/usr/lib/MailScanner/generic-wrapper and it explains what you get given
and what you have to return.

Then just put "generic" in the list of Virus Scanners in
MailScanner.conf and add your made-up virus name to the list of Silent
Viruses.

Give me a shout if you want some help, (particularly if you are able to
contribute) :-)

If you can give me a simple list of the filenames you are looking for,
then I should be able to write it in a few minutes for you.

Furnish, Trever G wrote:

>I have the terrible feeling that a way of doing this ought to be jumping into my mind, but I'm not getting it.
>
>I have a system configured which barely meets our load under the current sober onslaught and is not currently configured with any virus scanning, just spam filtering.  As such I hesitate to add any virus scanning as it might increase the server load too much.
>
>We're blocking the sober attachment filenames using filename.rules.conf, and I switched those rules from "deny" to "deny+delete" (not sure what that option is supposed to do - couldn't find documentation on it), but that doesn't stop the rest of the message from being delivered.
>
>Using spamassassin to mark the sober messages as 'high scoring spam' isn't really an option, because we still deliver 'high scoring spam' for other business reasons.
>
>Is there any way to delete the sober messages based on attachment filename, without running antivirus checks?  I suppose I could look at the code that interfaces to the "real" antivirus engines and hack up an engine to just reject those messages - I'm hoping there's an easier way.
>
>Thanks,
>Trever
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!