Bitdefender update?

[Glenn Steen]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On 03/11/05, Steve Freegard <smf at f2s.com> wrote:
(snip)
> If this is preventing you from releasing a legitimate message then you
> need to treat the cause of the problem:  a false-positive from the virus
> scanner, most of them that I've seen can be fixed by raising the
> 'ClamAVmodule Maximum Compression Ratio' module (if ClamAVmodule is
> used) or changing the settings in clamav-wrapper to achieve the same.

Ah, which would put the message as "un-releasable" (is there really
such a word?) in MailWatch.
Well, the simple fix (for the affected message, which is already past
the stage where adjusting the system so that it wont happen again
matters) is to just release it from the command line. most MTAs have a
nice "sendmail convenience command" for this purpose... as easy as
looking at the actual recipient in MW (if it differs from the headers)
and doing "sendmail -oi recipient at add.ress < /path/to/message/file"
(or similar... check the wiki when it's back online, perhaps there's
something specific for your MTA there).

(snip)
> > Would adding an option to the spam actions ( and high scoring spam
> > options) to forward to an alias pointed to the bitbucket cause a virus
> > scan of an infected spam message "before" it is stored?
> > Worth a try for a day or so.
> > You could probably forward a real spammy example from your archives,
> > with an eicar attachment and test it.
> >
>
> This does exactly the same thing as 'Keep Spam And MCP Archive Clean' -
> so it wouldn't make any difference.  I would only recommend this on
> MailScanner versions that don't have the proper option to do this.

I was under the impression that unlike the hack, which will leave the
message in both the spam and the virus quarantine, the "Keep Clean"
thing will actually remove the virus infected message from the spam
quarantine.
Am I wrong in thinking this?

>
> Cheers,
> Steve.
>
--
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!