Viruses flagged as spam too
james at gray.net.au
Fri Jun 6 10:17:34 IST 2008
On 06/06/2008, at 5:03 PM, Martin.Hepworth wrote:
> How many viruses are you seeing? Ie whats the size of the problem?
> For me i see very few (1 a day maybe), so this option wouldn;t gain
> me much.
Not that many - probably accounting for about 50% of all virus
detections, which in turn is less than 1% of total mail volume.
However, the work involved explaining that an email can be BOTH a
virus and spam is chewing up significantly more than 0.5% of our
support desk's resources (probably 1-2 man hours per day!).
Consequently I've been asked to investigate ways to mitigate the
confusion from a technical perspective, by avoiding the double
classification (if possible). Failing that, we'll try to educate the
users in a formal training scheme (probably just one of the support
people spending a few minutes with each business unit and backed up
with some documentation etc.) .... but as they say, "you can lead a
(l)user to a clue, but you can't make them think".
I also think Phil's comments regarding learning the viruses as spam
can have a positive effect when the viruses inevitably morph is
another bonus to throw at the "powers that be". However, protection
from a *possible* future threat doesn't solve the immediate problem of
disproportionate resource consumption of our support team. Frankly, I
don't really care about the processing overhead (the time is
negligible). I just want to avoid the double classification of spam
+virus. One classification or the other seems to be about all our
users are capable of processing in a single message :P
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2417 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080606/05705ca3/smime.bin
More information about the MailScanner