On Mon, 23 Jul 2007, John Scully wrote:
> ... After adding the sanesecurity sigs to clamd last
> week not one PDF has made it through. And since clamd unpacks and examines
> every attachment anyway it is no additional load. In fact, due to the
> messages not hitting SA it probably reduced load slightly.
I have a 'political problem' with that. We 'drop' knowv viruses into
a quarantine directory without further notice, and only once in years
somebody complained and wanted his virus back :-)
We *only* TAG spam with headers, then users decide to drop, move, or read it.
So if I 'simply insert' those clamav sigs, spam would be handled as a virus,
not as 'our spam', which I'm not allowed to destroy.
Did somebody of you create an extra 'instance' of clamad-filter to fight
spam with spam-sigs only, without scaning for virus-sigs? Does that
sound feasible?
Stucki
|