Jim Maul wrote:
I disagree. The "AV vendor" is the only entity capable of keeping such "meta data" about the virus Genus up to date. I'd love to see AVs say "this is virus XXX, and it is a mass-mailing virus".
This is not really a function of the av scanner, but rather a function of the program which is used to call the av scanner. clamav just says YES or NO it is a virus or isnt. Just as an example, im using qmail with qmail-scanner and clamav. qmail-scanner has the ability to define a list of mass mailing viruses to as to not send notifications to the sender.
ClamAV does add such details to the virus name - but I don't know how consistant it is.
Pardon, I didnt mean to imply that clamav doesnt provide the name of the virus as well. The point i was trying to make was that clamav itself doesnt know or care about what is actually done after the virus is detected. That part is left up to something else (qmail-scanner in my case).
Also, as Jim points out, the real issue these days is why send notifications at all? Almost all viruses are mass-mailing these days (I haven't seen a macro virus [that isn't a mass mailer] for several YEARS now), so it is WRONG to notify the sender - AS THEY DIDN'T SEND IT :-)
If i had a nickle for all the stupid "VIRUS DETECTED IN SENT MAIL" notices i receive daily....
-Jim _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
