1. If the message gets through because it is a corrupt version and non-viable, it will be delivered to the recipient, so no notification is sent.
2. If the virus scanner catches it but is not sure, it should report virus name Unknown. You can then add SKIPIFVIRUSNAMEHAS unknown in the appropriate .eml files. 3. If the message does not get picked up as infected, but has an banned attachment, it should be caught by that banned attachment. 4. You can also set up filter tests in JM to catch notifications/bounces from other servers. John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.Virus- > [EMAIL PROTECTED] On Behalf Of paul > Sent: Tuesday, September 02, 2003 12:55 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.Virus] FW: WARNING: YOU MAY HAVE A VIRUS > > John, Scott, everyone..... > > Question to this......... > > I have the SKIPIF lines in my eml files, but I was curious, what happens > to the corrupt versions of Sobig, etc that the attachments get through due > to no virus? Since these return addresses are no doubt bogus, is there a > guard against this? Do we have a SKIPIFATTACHMENTIS .scr option? > > Paul > > > --- > [This E-mail scanned for viruses by Declude Virus] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
