Ronald Vazquez NLM wrote:
(B> Hello:
(B>
(B> I have been tasked with configuring MIMEDefang to allow a virus to come in
(B> thru the first instance, tag it with X-RrestrictedAttachment to allow our
(B> virus scanner to process it. The idea is that once Trend Micro drops the
(B> attachment, we can scan the body with the second instance of MD and drop the
(B> virus notification.
(B>
(B> Why? There are some extensions that even though they are stripped, we do
(B> notify our users of the action so they can take appropriate action. This
(B> means that we only want to stop notifications for uncleanable attachments.
(B>
(B> Do anybody know a better way to accomplish this? The goal is to avoid
(B> notifying our users of every virus-infected email we drop while still
(B> notifying them about a VBA file they were waiting for.
(B>
(B> Thanks in advance,
(B> Ronald Vazquez
(BRonald,
(B
(B It seems to me that because of the nature of most of today's viruses,
(Byou don't want to send any notifications if they tested positive. Since
(Boften the sender is forged, it's generally a bad idea to notify the
(Bsender. Since it's a virus, it's not usually something expected by the
(Brecipient anyways, so the notification only adds noise to the end-user's
(Bmailbox.
(B
(Bin the case of a VBA file that gets quarantined or rejected, etc. that
(Bcould be caught with the bad_filename routines (not necessarily a virus)
(B and you could choose to make notifications seperate for those than your
(Bvirus handling. ALthough I would still caution that rejected
(Bbad_filenames will also hit potential virus attachments and still cause
(Bnoise down the line.
(B
(BAs a matter of policy, I reject (550 SMTP reject) any virus infected or
(Bbad_filename emails. if there's a legitimate user at the other end,
(Bthey'll get notification of the failure. if there isn't, the noise
(Bshould be minimal.
(B
(Bhope this is helpful
(B
(Balan
(B_______________________________________________
(BVisit http://www.mimedefang.org and http://www.canit.ca
(BMIMEDefang mailing list
([EMAIL PROTECTED]
(Bhttp://lists.roaringpenguin.com/mailman/listinfo/mimedefang
