It's not that difficult. The legitimate messages with rar attachments are big (usually 10MB and up) so it's not hard to separate them from the image spam and common viruses being held in the virus directory.
As mentioned by Craig in an earlier post, it would be nice if Declude added the capability to skip banning on files of large size. -------- Original Message -------- > From: "John T \(lists\)" <[EMAIL PROTECTED]> > Sent: Friday, April 27, 2007 3:56 PM > To: [email protected] > Subject: RE: [Declude.Virus] More info about encrypted RAR virus and Declude > failures > > > Until Declude resolves the issue with BANEXT EZIP, I've had to ban all > > rar files. Unfortunately some of my customers regularly send rar > > attachments, so I've had to check the virus hold directory on a regular > > basis and manually resubmit any false positives there. > > > > Gary > > Instead of manually checking for legit files, use the BANEXT.eml file to > send a postmaster message that you get and/or the recipient and/or sender > get and that notice can be reviewed a lot easier than manually checking the > hold directory. > > John T > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
