El vie, 30-01-2004 a las 13:31, Salvatore Toribio escribi�: > 1) The lastest viruses/worms always use a faked sender. Notifications??
It doesn't make sense to send a notification to the sender if his address has been faked, and sending a zillion notifications to the recipients is a PITA for them. I, for one, have added "worm" to the silent_viruses array on my mail servers (Kaspersky prepends all worm names with "I-Worm." and camscan with "worm."). > 2) If a virus scanner finds a virus, Is it useful to quarantine it? I think it's useful for viruses, but not for worms. Why? An e-mail sent by a worm is useless, crap to make the recipient open/read the mail and further spread the worm. An e-mail with an infected attachment can be useful, e.g., someone sends one of your customers an important document in MS Word's format and it happens to be infected by a macro virus... nevertheless, the .doc with all the info is still there, and if it's really important you (the admin) can retrieve the mail from the quarantine dir and clean the file. > 3) I can reject a virus in the smtp session instead of notifying the sender... Doesn't your patch already do that? (still haven't tried it but looking forward to). > 4) Woul be useful to add a "delete_virus_array" similar at > "silent_virus_array"? What for? Deleting the infected attachment and letting the rest of the mail go through? :m It could be useful, letting the _real_ mail without the virus _and_ with a notice about the infection and deletion of the attachment reach the recipient, instead of sending him the standard "a message for you was infected and blocked" alert... -- Vicente Aguilar <[EMAIL PROTECTED]> Departamento de Sistemas Tlf.: 965 98 71 92 Recursos en la Red, S.L.U. http://www.renr.es ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Qmail-scanner-general mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
