Grreting card scams

[Alex Broens]

On 7/27/2007 3:09 PM, UxBoD wrote:
> And so endeth Open Source Virus Scanners ! Remember, not everyone can
> afford or even wish to use a commercial virus scanner.

So true...

so what happens if one uses the Clam plugin with MCP?
(never used MCP)

Alex

> 
> --[ UxBoD ]-- // PGP Key: "curl -s https://www.splatnix.net/uxbod.asc
> | gpg --import" // Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1
> B02F 5DB5 687B // Keyserver: www.keyserver.net Key-ID: 0x5DB5687B //
> Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net
> 
> ----- Original Message ----- From: "Glenn Steen"
> <glenn.steen at gmail.com> To: "MailScanner discussion"
> <mailscanner at lists.mailscanner.info> Sent: Friday, July 27, 2007
> 1:22:43 PM (GMT) Europe/London Subject: Re: Grreting card scams
> 
> On 27/07/07, Alex Broens <ms-list at alexb.ch> wrote:
>> On 7/27/2007 2:00 PM, UxBoD wrote:
>>> The plugin looks good, but would also mean the message is scanned
>>> twice.  Also would require the new code Jules has written for
>>> setting the message as Virus when the SA ruleset is hit.
>>> 
>>> Double edged sword really as both incur a time/processing
>>> overhead IMHO.
>> Hoping not to start a philosophy war:
>> 
>> you *could* set MS to *only* use your *Highly respected Commercial
>> AV* and the plugin to use the Clam plugin.
>> 
>> *Highly respected Commercial AV* will kill the msg after Clam
>> plugin tagged as infected. (did I get my MS flow right?)
>> 
>> so what's left over in Quarantine is phishes and possibly new viri 
>> tagged with Clam's generic sigs, tagged as spam, (which comes in
>> handy to report to *Highly respected Commercial AV*'s dev team :-)
>> 
>> 
>> lots of ways to do stuff...
>> 
>> Alex
>> 
> Yes, you got it right:-). And with the new features, depending on
> exactly where in the process they're applied, the *HRCAV*s might not
> even see them. Upside on this approach is that there would eb a way
> to get the sigs to work without having to alter MailScanner core
> (source/concepts) behavior ... sort of. Jules will be happy:-).
> 
> If I find time away from my DBs today, and that very much overdue 
> update to thenetwork topology chart the PHB has been moaning about, I
>  might try this on today.
> 
> Cheers