Matthew van Eerde wrote:
> Rajanikanth P wrote:
> > Hello D.J. Fan,
> >
> > But i have a problem here. Assume that clam updates are published at
> > 6:10 Pm. I check for new updates at 6:05 so the next time i gonna
> > check is at 7:05 it just means that after 55 mins i got the updates.
> > And within this 55 minutes thousands and thousands of say ..a worm
> > which is in wild arrives to my mailserver and clam does not
> detect it
> > & it passes out what do i do ?
>
> Get together with five other organizations that use ClamAV.
> Each of you check at one of :05, :15, ... :55. If any one of
> you realizes that there's a new version, tell the other four.
A more practical solution is to do what I plan to do.
Reject anything that is a *known* virus
Accept but quarantine everything that isn't a known virus, but *looks* like a virus
(.exe, .zip, etc.) Have at least a two-hour cooling-off period to give your
definitions a chance to catch up to the virus writers - then rescan before you deliver
it to the recipient.
Pulling false positives out of quarantine is a pain - but much less of a pain than
having to clean up a network-wide infection.
[EMAIL PROTECTED] 805.964.4554 x902
Hispanic Business Inc./HireDiversity.com Software Engineer
perl -e"map{y/a-z/l-za-k/;print}shift" "Jjhi pcdiwtg Ptga wprztg,"
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
