Re: [Declude.Virus] AVAFTERJM -> was Feature request: DELETEVIRUSNAME

[Matt]

This is a big conundrum, and it would save me an unbelievable amount of money to change this behavior. I capture about 10% to 20% of spam to E-mail accounts and delete the rest.  If I turn AVAFTERJM ON, I would end up with viruses all over my capture accounts and that just can't happen because non-administrators review these accounts and they can reprocess these E-mail's with a single click. What I really need is a switch in Declude Virus that will allow it to scan all messages that aren't deleted.  If I am correct, Declude Virus is not called when a ROUTETO action is taken on a message.  Please correct me if I am wrong here.  If I am correct, it would make sense to run Virus on anything that is delivered somewhere, or at least give us the option of specifying.  For instance, it would be good to do either one of the following:     Option #1 - Specify which actions to run Virus when AVAFTERJM ON is used         RUNAVAFTERJM   ROUTETO         RUNAVAFTERJM   COPYTO         RUNAVAFTERJM   HOLD     Option #2 - Specify which tests should NOT trigger Virus when AFTERJM ON is used.        DONTRUNAVAFTERJM   WEIGHT20 Either option would be a tremendous benefit to me.  Right now I am moving to a two server solution for this where JunkMail is on the first box, and Virus is on the second box.  This has tremendous overhead to me since it requires a server (~$2,500), OS and IMail licenses (~$1,500) and rack space (~$50/U/month).  Note that doing this separation does not cost extra for Declude licenses since each server would only run one function.  I would much, much rather invest in redundancy though, and have the option of adding a new box with both JunkMail and Virus.  In essence, this is costing Declude money since I have been spending all of my money on servers thus far and it is dragging out my growth.  The savings for me would be huge. If I am wrong about the behavior of AVAFTERJM, please point out my mistakes. Matt Colbeck, Andrew wrote: Do you mean this script on my disk who creates one hour each day with 100% CPU usage? Markus, I found that a pretty fun bit of sarcasm. But I have a dry sense of humour. It sounds like you're not using AVAFTERJM so that you catch viruses as viruses and spam as spam. In this scenario I'm pretty confident that you could automate grepping your virMMDD.log file hourly, look for a pre-set list of virus names, cut up the Q* column to derive the filename, and delete the Q*.SMD and D*.SMD file, for example, this line: 01/24/2006 18:54:38 QE867AAFA0144EA71 File(s) are INFECTED [ W32/[EMAIL PROTECTED]: 3] Is quite easy to parse. Let me share something similar I've done. I've remarked on it vaguely before... I wanted to nail down some of my statistics, and as that evolved, I wanted to know how much of the inbound mail that is blocked as spam was actually viral. It turned out that I block a lot of viruses as spam because they have the same IP source characteristics, malformed headers, fake source domains and so forth as zombie spam (no surprise, they're much the same machines). Like you, I have a system that blocks a ton of mail, so I run AVAFTERJM to cut down on the work, and this definitely leaves a gap in my statistics. Similarly, it follows that I wouldn't want to scan my whole SPAM folder. Even reading the directory of the filenames is a disk workout. During our slow period (nightly) I do a scheduled run of a .cmd script that uses the GNU utilities to check my Declude logs for the held spam for that day only, I weed out ones that triggered SNIFFERMALWARE or my own Declude filter tests for viruses, then from that subset I have a list of Q* names. >From that Q* column, I can form the filename. I then grep each one of those files for strings that would indicate that there is a possibly viral attachment (it's not perfect), and then on the remainder of the filenames, I invoke my F-Prot scanner and check the result code for each file. This isn't ideal, but I found that invoking it every time with specific filenames was far, far faster than scanning a folder. Windows certainly caches the fpcmd and pattern files, so that definitely helps. How much am I saving? Well, I am scanning all the files in some fashion, but I'm doing grep for some spam and grep plus antivirus for the minority of it, and I'm doing it outside of our busy hours. It takes *two hours*, and produces results like this in a day: Viruses caught by Declude Virus after using AVAFTERJM: 1 Messages caught by filters or Sniffer: 349 Messages scanned "after hours": 25,000 Viruses found "after hours": 378 So, I time-shifted away from normal hours the CPU and disk hit of doing the scanning, and I still get my virus statistics without causing a performance problem at night. The resulting logs are easily grepped for virus names and counts if I want. I use another set of scripts to compile the stats at the end of the month, with little to no maintenance. It's awful code, but if a non-programmer like me can do this, your virMMDD.log can be used to delete the messages for viruses you don't want to keep on disk. Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Markus Gufler Sent: Wednesday, January 25, 2006 10:13 PM To: Declude.Virus@declude.com Subject: RE: [Declude.Virus] Feature request: DELETEVIRUSNAME As a work around until and if Declude adds the requested feature, you could write a script to search the files on a timed based for a phrase (virus name) and have it delete them. Do you mean this script on my disk who creates one hour each day with 100% CPU usage? Markus --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.