On 24.07.07 08:57, Kelson wrote: > Over here we use MIMEDefang as the glue to tie SpamAssassin, Clamd, etc. > together. MD filters are very customizable (if you can write it in > Perl, you can put it in a MD filter). After our filter calls clamd, we > check the name of the matching signature against a regexp. We only > actually drop messages that trip on known mass-mailer signatures (most > of them have "worm" or "@mm" in the name, depending on who first named > it), and the rest are rejected.
This it sick. Why not reject all viruses, independently on whtat they do? Why not let the sender deal with the rejection? Either the sending server will generate bounces (and the admin learns to install antivirus) or the sending bot will not have its mail accepted. I know that there were recommendations in the past "not to send notification to the sender, when the virus name contained '@mm'" but they were invalid because of more reasons. And they were about _notifications_ to "senders". Do never notify sender or receiver about the virus. Senders are in most cases fake and the receivers do not want to know that whole spambot army started sending them viruses. -- Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Quantum mechanics: The dreams stuff is made of.
