If virus, don't scan with SA

[Chris Barber]

on 7-23-2008 12:59 PM Chris Barber spake the following:
> Hi All,
> 
> I was wondering if the following is possible with MS:
> 
> If a message can be virus scanned first, and it found to be a virus, 
> can SA scanning be skipped?
> 
> The reason I ask is that I use the sanesecurity signatures for clamav.
> If sanesecurity says it is spam/phish/etc then no need for SA 
> processing taking up resources.
> 
> On a side note, to date I have never had a false positive with these 
> signatures.
> 
> Thanks much,
> Chris
> 
If you want to virus scan first, run a milter. That way you can drop it at the smtp phase.
Personally, I have had false positives with the sane sigs, but it has been when they posted a bad signature, and they fixed it quickly.


That is not a bad idea using a milter. Only issue is that I use MailWatch with daily reports, users like to see that viruses are being blocked. I'll have to think about this one.
Thanks