John, Unfamiliar with Declude's AV options so I'm uncertain what you mean, but all I'm looking to do is kill messages generated by Sobig before they get pushed through spam tests. If I can do that with Scott's AV package, bring it on!
Dan On Sunday, August 24, 2003 23:10, John Tolmachoff \(Lists\) <[EMAIL PROTECTED]> wrote: > >The problem is when it comes to notifications and requeing. If >a message gets stopped by banned extension first, and it is >infected, you are going to be sending out a notice to the >recipient of the blocked message. He is going to tell you hey, >I know that send, and such and you are going to requeue it and on the virus goes. >� > > >John Tolmachoff MCSE CSSA >Engineer/Consultant >eServices For You >www.eservicesforyou.com >� > >-----Original Message----- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble >Sent: Sunday, August 24, 2003 6:31 PM >To: [EMAIL PROTECTED] >Subject: Re: [Declude.JunkMail] Multi Server Configs >� >Dan, > > It appears that E-mail is first scanned by the virus scanner >(F-Prot or whatever), and then if it passes, the excluded >extensions are tested.� So as soon as your virus scanner became >Sobig.F aware, the excluded extensions test doesn't get done >because it is blocked by the scanner.� Maybe Scott can suggest >other ways to save processing power? > > Scott, > > I know this is the wrong discussion group, but since we're on >the topic, would it make more sense to test for banned >extensions before it goes to the virus scanner in order to save >processing power? > > Matt > > Dan Patnode wrote: > > >Matt, by this: > >� > >� > >This does tie back into processor utilization though, because > >before the definitions were available, the banned extension > >test was placing those E-mails in a hold (wish you could have > >them deleted).� The system seems though to scan the attachments > >first and then look for attachments to ban by extension, and > >that order could be reversed to save processing power.� I > >assume this because the virus detection is now catching these > >files subsequent to the definitions update instead of the > >banned extension test doing the dirty work.� > >��� > >� > >are you saying that I could set up Fprot to scan for .pif files >and then have it run before Declude's junk filters, >holding/deleting them, saving the CPU from scanning these >messages with my junk tests?� > >� > >Can this be confirmed, Scott? > >� > >Dan > >� > >� --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
