On Sat, 2003-09-20 at 12:16, Thomas Lamy wrote: > Antony Stone wrote: > > On Saturday 20 September 2003 4:54 pm, Daniel J McDonald wrote: > > > > > >>On Sat, 2003-09-20 at 10:40, Antony Stone wrote: > > > > > >>>A gif is not a virus, so it should not be detected by an anti-virus > >>>program. > >>> > >>>Anyway, what's the point? Why bother blocking a 'damaged' copy of a > >>>virus, where 'damaged' actually means 'missing'? > >>Do you want your clueless users calling you all day asking why they > >>can't find the patch that Microsoft e-mailed them? > > Are you suggesting that you allow emails with a .exe attachment to be > > delivered? > > > > I regard that as a sufficient reason to block an email, whether the .exe is a > > virus or not.
Yes, I do block all .exe files, but my filter behaves differently if it detects a virus. If there is a virus, it cheerfully accepts the mail (250) and then silently tosses it in the quarantine folder. If there is not a virus, it marks it permanently undeliverable (554) and sends a DSN stating that we don't accept any of a rather long list of extensions - you do block all 20-30 of the documented and undocumented executable extensions for Windows, right? So, with damaged viri, we end up sending lots of DSN's - wasting my server's time and innundating the poor spoofed sender. Thus, I would prefer that clamav be able to determine if it appears to be a virus, even one damaged to the point of non-existance. -- Daniel J McDonald, CCIE 2495, CNX Austin Energy ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
