Gianmarco Giovannelli wrote: > >But you have the PIF in quarantine anyway. Couldn't you save CPU by > >PIF-blocking the attachment, then scanning it later (during off-peak > >hours, or in a nice process) to find out what virus it was? > > This is not to be happened, usually you block in advance such attach > name on a company policy or because of your policy. > Your users are usually awarned that "pif file is not a valid attach and > it will be rejected". > > Btw: > I told this because this was one thing that RAV AV had and it is the > first thing our companies usually ask for > Now we are told that vexira/avmilter will have this soon... I saw that > virusbuster has ...
> So I thought it was a smart thing to have for clamav-milter too, but it > is not a problem if it dislikes to everybody :-) Again, though, this is down to the content filters. I don't run clamav-milter as I don't use Sendmail, so I am unsure of its semantics, but as to whether you want first match wins or multiple checks for in depth info is something that can easily be configured or added in most decent content-filters. However, just to be specific on the point, and emphasise Nigel's earlier statement, his milter is not a content filter. Matt _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
