Viruses flagged as spam too

[James Gray]

On 06/06/2008, at 5:03 PM, Martin.Hepworth wrote:

> James
>
> How many viruses are you seeing? Ie whats the size of the problem?  
> For me i see very few (1 a day maybe), so this option wouldn;t gain  
> me much.

Not that many - probably accounting for about 50% of all virus  
detections, which in turn is less than 1% of total mail volume.   
However, the work involved explaining that an email can be BOTH a  
virus and spam is chewing up significantly more than 0.5% of our  
support desk's resources (probably 1-2 man hours per day!).   
Consequently I've been asked to investigate ways to mitigate the  
confusion from a technical perspective, by avoiding the double  
classification (if possible).  Failing that, we'll try to educate the  
users in a formal training scheme (probably just one of the support  
people spending a few minutes with each business unit and backed up  
with some documentation etc.) .... but as they say, "you can lead a  
(l)user to a clue, but you can't make them think".

I also think Phil's comments regarding learning the viruses as spam  
can have a positive effect when the viruses inevitably morph is  
another bonus to throw at the "powers that be".  However, protection  
from a *possible* future threat doesn't solve the immediate problem of  
disproportionate resource consumption of our support team.  Frankly, I  
don't really care about the processing overhead (the time is  
negligible).  I just want to avoid the double classification of spam 
+virus.  One classification or the other seems to be about all our  
users are capable of processing in a single message :P

Cheers,

James
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2417 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080606/05705ca3/smime.bin