RE: [Declude.JunkMail] Multi Server Configs

[John Tolmachoff \(Lists\)]

The problem is when it comes to notifications and requeing. If a message gets stopped by banned extension first, and it is infected, you are going to be sending out a notice to the recipient of the blocked message. He is going to tell you hey, I know that send, and such and you are going to requeue it and on the virus goes.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matthew Bramble Sent: Sunday, August 24, 2003 6:31 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Multi Server Configs   Dan, It appears that E-mail is first scanned by the virus scanner (F-Prot or whatever), and then if it passes, the excluded extensions are tested.  So as soon as your virus scanner became Sobig.F aware, the excluded extensions test doesn't get done because it is blocked by the scanner.  Maybe Scott can suggest other ways to save processing power? Scott, I know this is the wrong discussion group, but since we're on the topic, would it make more sense to test for banned extensions before it goes to the virus scanner in order to save processing power? Matt Dan Patnode wrote: Matt, by this:     This does tie back into processor utilization though, becausebefore the definitions were available, the banned extensiontest was placing those E-mails in a hold (wish you could havethem deleted).  The system seems though to scan the attachmentsfirst and then look for attachments to ban by extension, andthat order could be reversed to save processing power.  Iassume this because the virus detection is now catching thesefiles subsequent to the definitions update instead of thebanned extension test doing the dirty work.      are you saying that I could set up Fprot to scan for .pif files and then have it run before Declude's junk filters, holding/deleting them, saving the CPU from scanning these messages with my junk tests?   Can this be confirmed, Scott? Dan