Re: Exiscan: notifications?

On 20 Dec 2004, Rich at Whidbey Telecom wrote:

> On Dec 20, 2004, at 10:32 AM, Steffen Heil wrote:
> > And you should never accept a virus, you should deny it.
> 
> Please do not put a "deny" in your Exim configuration.  That will 
> produce a bounce to the impersonated sender.

That's an incorrect assertion. In most cases it will not cause any kind of
bounce. Almost all viruses I see rejected are coming direct from
obviously-compromised hosts - that is, sent direct by an SMTP engine
within malware. (Or are bounces - with a null sender - containing the
complete virus) In those cases, no bounce will be generated. Indeed, in
the latter case (bounces), it has a positive effect because it fills up
the queues of ISPs that are accepting viruses and generating collateral
bounces, hopefully prompting them to notice and take some action.

> You must accept viruses because the sender is forged.  Otherwise, you 
> will be bouncing them back to an innocent party.

Again, not really true. And saying you "must" accept them potentially
makes the situation worse because unless you manually check each mail, you
run the (small) risk of losing mail in the event that your virus scanner
incorrectly identifies a mail (it happens) or in the unlikely event of a
genuine mail with a macro virus or whatever.

[snip lots of quarantiney stuff]
> Last but not least, write a simple script to delete messages from your 
> quarantine,

Can't you just use "discard malware = *" at the ACL stage if you're just
going to throw the mail away anyway?


Tim