[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Virus emails

On Tue, 23 Sep 2003 08:39:02 -0400
"H. S. Teoh" <hsteoh@quickfur.ath.cx> wrote:
> On Mon, Sep 22, 2003 at 08:46:15PM -0700, Steve Lamb wrote:
> >     Except it never hits SA nor do I even have procmail installed.  Can't
> > stand the ugly beast.
> It never hits SA? Almost all Swen mails I got were caught by my bogofilter
> + SA setup. (It only missed like 2-3 out of at least 5000 per day.)

    Exiscan-ACL gets the message before Spamassassin does.  So the checks are:

Exiscan-ACL says Malformed MIME?  Reject.
Clamav says Malware (virus, worms, trojans, etc)?  Reject.
Spamassassin says its spam?  Reject.
> I noticed this also. However, I found that some of the subnets I blocked
> "rested" for several hours, and then started bombarding me again. So I'm
> leaving the rules in for at least a couple o' days before cleaning out
> those with 0 count.

    Hrm, well the cycle of when to remote and reset could be tuned for daily
or weekly operation.  :)

         Steve C. Lamb         | I'm your priest, I'm your shrink, I'm your
       PGP Key: 8B6E99C5       | main connection to the switchboard of souls.

Attachment: pgp5tF60fFoSR.pgp
Description: PGP signature

Reply to: