>Pardon, I didnt mean to imply that clamav doesnt provide the name of the >virus as well. The point i was trying to make was that clamav itself >doesnt know or care about what is actually done after the virus is >detected. That part is left up to something else (qmail-scanner in my >case).
>> Also, as Jim points out, the real issue these days is why send >> notifications at all? Almost all viruses are mass-mailing these days (I >> haven't seen a macro virus [that isn't a mass mailer] for several YEARS >> now), so it is WRONG to notify the sender - AS THEY DIDN'T SEND IT :-) >> >If i had a nickle for all the stupid "VIRUS DETECTED IN SENT MAIL" >notices i receive daily.... >-Jim >_______________________________________________ >http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Thanks for all the replies. All I would want clamav to do is put something like @mm (does not have to be that, but just some unique identifier for mass mailers. I could then use Exim or amavisd to drop it based on the virus name. I really do not want to have to maintain a maunally populated list of mass mailing viruses. I guess we could look at deleting any email with an infected file, but I know that would come back and bite me on the @55. It is good to know that I could probably use Worm* or @mm and drop based on that. As far as notifications, I would never send someone a notification saying there was a virus in an email they sent, does not make sense anymore. Again thanks for the feedback. Looks like I can drop Symantec :) _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
