On Fri, 2004-12-17 at 10:56 -0700, Carnegie, Martin wrote: > Hello all, > > Yep another newbie question. > > We are currently looking at switching to Clamav from Symantec SMTP and > there is one feature that I really like from Symantec that I cannot find > in Clamav (at least I cannot find). This is the ability to identify > mass-mailing viruses based on the name of the virus detected. For > example the W32.Beagle (or Bagle) from Symantec shows up as > [EMAIL PROTECTED] This means that can then drop any messages with the > @mm instead of just removing the attachment and sending on to the > client.
I'd suggest dropping them all. Other than a few word-macro viruses, most everything still in the wild spoofs the sender address. And, because of excessive backscatter, nobody believes anyone else's virus scanner anyway, so it's best to just bit-bucket them. -- Daniel J McDonald, CCIE # 2495, CNX Austin Energy [EMAIL PROTECTED] _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
