Re: [Assp-user] Virus scoring

2007-07-31 Thread Matti Haack
Thats exactly the reason for my suggestion. As I don't trust these sansecurity definitions completely, I would like to give them a lower score, so that they are not blocked, but marked as spam. If it would possible to implement this feature without hazzle, it would be great to have it Matti

Re: [Assp-user] Virus scoring

2007-07-30 Thread Kevin
David wrote: > I'm glad you get it! These optional clamav definitions are really great. > Since a virus hit will outright kill a message, it would be cool to be > able to have clamd scanning higher up in the queue so as to avoid > extraneous scanning, too. Other than Bayesian (for me at least)

Re: [Assp-user] Virus scoring

2007-07-30 Thread Kevin
David wrote: > The idea is that there are additional clamd definitions one can use to > scan for spam such as the MSRBL definitions ( http://www.msrbl.com/site/ > ) and the SaneSecurity definitions ( > http://www.sanesecurity.co.uk/clamav/ ) that have been discussed here > earlier. > > These d

Re: [Assp-user] Virus scoring

2007-07-30 Thread David
I'm glad you get it! These optional clamav definitions are really great. Since a virus hit will outright kill a message, it would be cool to be able to have clamd scanning higher up in the queue so as to avoid extraneous scanning, too. Micheal Espinola Jr wrote: > David wrote: > >> I hope th

Re: [Assp-user] Virus scoring

2007-07-30 Thread Micheal Espinola Jr
David wrote: > I hope that covered everything. Totally. Thanks for that. I think I'm caught up with the conversation/issue now! I can see the point of what you mean now. The regex scoring is intriguing. I don't use ASSP that way, but I'm interested to see how this conversation turns out. Tha

Re: [Assp-user] Virus scoring

2007-07-30 Thread David
The idea is that there are additional clamd definitions one can use to scan for spam such as the MSRBL definitions ( http://www.msrbl.com/site/ ) and the SaneSecurity definitions ( http://www.sanesecurity.co.uk/clamav/ ) that have been discussed here earlier. These definitions allow one to use

Re: [Assp-user] Virus scoring

2007-07-30 Thread Micheal Espinola Jr
David wrote: > I think the request for virus scoring comes not to score executable > binary viruses, but to score the wide variety of non-virus items now > I don't understand the concept of virus scoring for non-virus items. Please elaborate.

Re: [Assp-user] Virus scoring

2007-07-30 Thread David
I think the request for virus scoring comes not to score executable binary viruses, but to score the wide variety of non-virus items now caught by things like the MSRBL and SaneSecurity definitions. I also think that's why the feature was requested to use regexes, so that one could differential

Re: [Assp-user] Virus scoring

2007-07-30 Thread Micheal Espinola Jr
Kevin wrote: > We don't score Virus hits, they are only blocked. Fritz says he does not > see a valid reason to change this, i agree. Same here. An attachment is a virus or its not. This is a binary issue: 1 or 0, on or off. When something is *fundamentally* bad for you, why consider it as an

Re: [Assp-user] Virus scoring

2007-07-30 Thread Kevin
Matti Haack wrote: > Hello Fritz, > > what do you think of the idea to add the possibility to test the > clamav results against an regex. If it matches, a different per message > score could be added. > So it would be possible to give the sanesecurity (or other not 100% > proofed signatur

[Assp-user] Virus scoring

2007-07-30 Thread Matti Haack
Hello Fritz, what do you think of the idea to add the possibility to test the clamav results against an regex. If it matches, a different per message score could be added. So it would be possible to give the sanesecurity (or other not 100% proofed signatures) viruses a lower score than th