On 2/23/06 12:56 PM, "Jason Haar" <[EMAIL PROTECTED]> wrote:
> Richard Feldmann wrote:
>>
>> It might be best to find a scanning system that checks at the smtp level,
>> rather than scanning the mailbox of the user manually. This would delete the
>> virus as it's being transferred while preserving the message, and you
>> wouldn't have the same issue of having the entire mailbox being deleted.
>>
> That's not standard practice. Most sites not only scan as mail comes in
> via SMTP, but they also scan *nightly* the end mailstores to pick up
> viruses missed at the SMTP level (e.g. Day-Zero viruses)
>
> Just because a message got delivered doesn't mean it doesn't have a virus...
You scan at smtp, you scan nightly at the mailstore, and you scan at the
desktop...preferably with different brand scanners. That avoids exposure
during the "day-zero" window.
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
