Bitdefender update?

[Scott Silva]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ed Bruce spake the following on 11/2/2005 10:37 AM:
> Scott Silva wrote:
> 
>>Ed
>>
>>>
>>>Yup. We had to shutdown all the computers yesterday. Was in a meeting
>>>discussing the dangers of hooking up laptops to our network, when one of
>>>our techs sticks his in the door and says we seem to be having a
>>>problem. I was only running ClamAV but it stopped all the Bagle variants
>>>hitting us through email.
>>>
>>>Just for grins I ran ClamAV and BitDefender against the email archives
>>>and lots of email infected, but not detected because they were
>>>identified as Spam. Must think on this because I have email not cleaned
>>>up so people can release from Quarantine. Now we could be releasing
>>>infected emails.
>>>
>>>    
>>>
>>You could run with the "keep quarantine clean" option.
>>WIll add to load because MailScanner will virus scan the spam also.
>>
>>
>>  
>>
> 
> But if I do that then I can't use MailWatch to release messages form
> quarantine. It appears that the clean up is storing emails in a format
> that can't be released from Quarantine. I'm still not sure what to do or
> what I did that may have caused this. I'm still looking at the options.
> We've had a few important emails that were misidentified and I was able
> to just release them from quarantine. But only because I had removed the
> keep quarantine clean option.
> 
Would adding an option to the spam actions ( and high scoring spam
options) to forward to an alias pointed to the bitbucket cause a virus
scan of an infected spam message "before" it is stored?
Worth a try for a day or so.
You could probably forward a real spammy example from your archives,
with an eicar attachment and test it.



-- 

/-----------------------\           |~~\_____/~~\__  |
| MailScanner; The best |___________ \N1____====== )-+
| protection on the net!|                   ~~~|/~~  |
\-----------------------/                      ()

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!