If virus, don't scan with SA

[Scott Silva]

on 7-23-2008 3:34 PM Chris Barber spake the following:
> on 7-23-2008 12:59 PM Chris Barber spake the following:
>> Hi All,
>>
>> I was wondering if the following is possible with MS:
>>
>> If a message can be virus scanned first, and it found to be a virus, 
>> can SA scanning be skipped?
>>
>> The reason I ask is that I use the sanesecurity signatures for clamav.
>> If sanesecurity says it is spam/phish/etc then no need for SA 
>> processing taking up resources.
>>
>> On a side note, to date I have never had a false positive with these 
>> signatures.
>>
>> Thanks much,
>> Chris
>>
> If you want to virus scan first, run a milter. That way you can drop it at the smtp phase.
> Personally, I have had false positives with the sane sigs, but it has been when they posted a bad signature, and they fixed it quickly.
> 
> 
> That is not a bad idea using a milter. Only issue is that I use MailWatch with daily reports, users like to see that viruses are being blocked. I'll have to think about this one.
> Thanks
> 
You can't really do it in mailscanner, since it scans in batches and it is 
hard to control if spams and viruses are mixed in a batch. Here at least, the 
percentage of things that hit the sane sigs is small as a percentage of total 
spam. So having 1% or less of your spam get skipped is not that big of a deal. 
Maybe you could run messages through a milter like mimedefang and just add a 
header. Then you could use a custom function to not scan those messages. But 
it is a lot of work for a small return.



-- 
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080723/309ce00d/signature.bin