On Thu, Feb 23, 2006 at 09:56:23AM -0700, Richard Feldmann wrote: >It might be best to find a scanning system that checks at the smtp level,
Sometimes I think that scanning at end-user's mailbox access level (eg. POP3) could be even better, as it gives additional time for signatures database update to appear. Of course every model has its pros and cons. For example, SMTP has only one DATA phase, even if the message has multiple recipients. So we are saving lot of resources (CPU cycles and storage space) that way. So, it seems if one can afford it, it could be wise to make an additional av-check, at end-user delivery level. We are doing av-scan at least twice for single accepted message then, but we are certain we did everything we could to protect users. Of course this check at POP3 level is very similar in effectiveness (in lab conditions) to end-users' desktop av-scanners, but relying on users usually leads ... ;-) -- Jacek Politowski _______________________________________________ http://lurker.clamav.net/list/clamav-users.html
