On Mon, 23 Jul 2007, John Scully wrote: > ... After adding the sanesecurity sigs to clamd last > week not one PDF has made it through. And since clamd unpacks and examines > every attachment anyway it is no additional load. In fact, due to the > messages not hitting SA it probably reduced load slightly.
I have a 'political problem' with that. We 'drop' knowv viruses into a quarantine directory without further notice, and only once in years somebody complained and wanted his virus back :-) We *only* TAG spam with headers, then users decide to drop, move, or read it. So if I 'simply insert' those clamav sigs, spam would be handled as a virus, not as 'our spam', which I'm not allowed to destroy. Did somebody of you create an extra 'instance' of clamad-filter to fight spam with spam-sigs only, without scaning for virus-sigs? Does that sound feasible? Stucki
