On Fri, 30 Jan 2004 at 17:03:05 -0500, Jason Frisvold wrote: > Hi all, > > How does everyone handle the clamav quarantine? I'm running clamav w/ > qmail-scanner and every virus laden email gets put into the quarantine > folder... Is it even worth it to quarantine at all? >
Yes, it is worth! Sometimes (though rarely) a stopped message isn't really infected. False positives happen. Other reason of stopping a message may be excessive compression ratio of an attached archive, which can turn out to be quite innocent file. So you may trace AV log and notice uncommon viruses (or false viruses) and other reasons of stopping a message. Later you can delete older quarantined messages. Better check than sorry. -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. [EMAIL PROTECTED] http://www.ClamAV.net/ A GPL virus scanner ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
