[Mimedefang] Sven is driving me crazy!

[Kris Deugau]

"Michael W. Cocke" wrote:
> When mimedefang (2.36) performs an action on a message (removes an
> attachment, the virus checker that mimedefang calls detected a virus,
> etc.) does the message get sent along to the next step in the normal
> process, or does it short cut.

IIRC, the default filter in 2.36+ rejects messages found to contain a
virus with a 550 SMTP message.  (action_quarantine followed by
action_bounce)

I've modified my filters to quarantine and discard;  there's little
point in rejecting it IMHO.  I figure that since I've already spent
network and computing resources to accept the message and process it
that if it's nastyware it's better deleted than kept.  :/

(action_quarantine followed by action_drop currently, although one
system [with no actual AV, just the "bad extension" check] is set up
with action_quarantine_entire_message)

> (I'm still getting the stupid message, sans virus - about 100 an hour
> right now)  ARRRGGGGHHHHH!!!!!

It sounds like you've got your filter set up to call action_drop on
virus parts, but you don't call action_discard to actually delete the
*message*.

-kgd
-- 
<erno> hm. I've lost a machine.. literally _lost_. it responds to
ping, it works completely, I just can't figure out where in my
apartment it is.