> Instead of doing something like that, which will require > on-going, hands-on maint, why not just tag to hold those > which are identified by the scanner as suspicious or generic > and delete the rest?
This is another possible solution but my intention is to clean my server from messages containing certain viruses. Thus are the well know top viri like Sober, Netsky and Co. Deleting them immediatly there will remain only a little crowd of viruses and suspicious files. Whatever will happen in the future I have them on my server and can keep it there also for one or two weeks in the case it turns out that some user is missing a legit message. In this cas I can find the message in my virus-folder on the server and requeue it even if it was "false positive"-identified by some scanner as a fiften year old "tequila"-Virus. Andrews idea to parse the virus logfile instead of the content from each virus-message is definitively an excellent idea. However there is a more simplier and efficient possibility if we could delete infected messages by the virus name. Markus > > > Wednesday, January 25, 2006, 4:37:28 PM, Markus Gufler > <[EMAIL PROTECTED]> wrote: > MG> Maybe someone has already requested it: > > MG> Why not allow commands like > > MG> DELETEVIRUSNAME Netsky > MG> DELETEVIRUSNAME Bagle > MG> ... > > MG> in the virus.cfg file? > > MG> I won't and can't delete all viruses on our server > because there is > MG> always the possibility that a scanner is catching something as > MG> "suspicious" or "generic" > > MG> But commands to delete certain virusnames should be very easy to > MG> implement and allow us to eliminate > 95% of all hold > viruses on out servers. > > MG> Markus > > MG> --- > MG> [This E-mail was scanned for viruses by Declude EVA > www.declude.com] > > MG> --- > MG> This E-mail came from the Declude.Virus mailing list. To > MG> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > MG> type "unsubscribe Declude.Virus". The archives can be found > MG> at http://www.mail-archive.com. > > > > ---- > Don Brown - Dallas, Texas USA Internet Concepts, Inc. > [EMAIL PROTECTED] http://www.inetconcepts.net > (972) 788-2364 Fax: (972) 788-5049 > ---- > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
