You may be able to do something with the MSGSIZE test in conjunction with AVAFTERJM ON eg.
SIZE-10MB msgsize 10240 x -50 0 David Barker VP Operations | Declude Your Email Security is our business O: 978.499.2933 x7007 F: 978.988.1311 E: [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Steiner Sent: Friday, April 27, 2007 4:25 PM To: declude.virus@declude.com Subject: RE: [Declude.Virus] More info about encrypted RAR virus and Declude failures It's not that difficult. The legitimate messages with rar attachments are big (usually 10MB and up) so it's not hard to separate them from the image spam and common viruses being held in the virus directory. As mentioned by Craig in an earlier post, it would be nice if Declude added the capability to skip banning on files of large size. -------- Original Message -------- > From: "John T \(lists\)" <[EMAIL PROTECTED]> > Sent: Friday, April 27, 2007 3:56 PM > To: declude.virus@declude.com > Subject: RE: [Declude.Virus] More info about encrypted RAR virus and > Declude failures > > > Until Declude resolves the issue with BANEXT EZIP, I've had to ban > > all rar files. Unfortunately some of my customers regularly send > > rar attachments, so I've had to check the virus hold directory on a > > regular basis and manually resubmit any false positives there. > > > > Gary > > Instead of manually checking for legit files, use the BANEXT.eml file > to send a postmaster message that you get and/or the recipient and/or > sender get and that notice can be reviewed a lot easier than manually > checking the hold directory. > > John T > > > > > --- > This E-mail came from the Declude.Virus mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
