[Mimedefang] Why scan for viruses twice in the default filter?

[David F. Skoll]

On 6 Oct 2002, Tim Kramer wrote:

> 1) Is there a reason why virus scanning is called
> for in sub filter_begin() AND sub filter() ?

The initial scan scans all of the files in the working directory.  This
is typically faster than scanning each file with a separate invocation of
the scanner.

If, and only if, the first scan found a virus, each part is scanned in
filter() to narrow down the infected part and the virus name.

> 2) Why is the virus scanner called AFTER the
> bad extension filter and spamassassin?  If you're
> letting users connect to the site with a browser
> and get their mail, shouldn't you not allow
> collection of infected mail?

The order doesn't really matter.  (In fact, in my filter, it's called
first.)  What you do with the mail is up to you.  The sample filter
quarantines infected or bad parts, making them inaccessible to normal
users.

--
David.